From 4e1108654a6a5301adf823eda0de870f5167ddbc Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Tue, 1 Jun 2021 16:19:14 +0200 Subject: [PATCH 1/5] add gpg public key to verify board_index.json --- .../security/keys/board_index_public.gpg.key | Bin 0 -> 1754 bytes arduino/security/rice-box.go | 16 ++++++++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) create mode 100644 arduino/security/keys/board_index_public.gpg.key diff --git a/arduino/security/keys/board_index_public.gpg.key b/arduino/security/keys/board_index_public.gpg.key new file mode 100644 index 0000000000000000000000000000000000000000..22fb62e0c35977167febd1056ddd2f51967650ee GIT binary patch literal 1754 zcmajeSu`7n0)SyjkOWntjFQo~6sTw!p>?-&&zZOT{=fa_D+FZndp1G101>{WaWW}s3?g=(o5U!e zX%28?rRLu&%kC4q5B{d5qtR1u^-%&4DOT$7#o|ZLmG(reX>wETWbkT!@x|~xHVxAA z4dqG>L4PS!QdUopBxlbnx|^i&c2}=$zhRlRQmjHe7u#8`J1?wB&YK?6+?_6DQ%C9h zmPnxy<@CjhDwI#D={{*pDj@52B~n@Y2$kjL7$MadjQuLpN2hQmK(Eo85jpxr*M?;3 z?Y86Q6l>PjDWskAS4?ZGT}T(gPhwS7JJMo3lyHk60?Y;FH_qeyTukjlTvWA9^1kSfS{6t)6||PdTIzvSe6`1_UfOl{j{$AaHBHrdTK ztoi@de9#=<8~2IrqZ2Heas78fCWuwn7lWVFj}57_{>LdU7n!rY8RTu!pPZuzFycj6 zF%K0-+c7xdsZX~aE_74z4qaX@#>JV$oi^ooqqQby4IAMy#<0}G4ddEh2_HFl@jw%Y zF!@U@<&gbNtUb1tNEfS-3fd{dI(-muVOl0M)Gk<^e>ji?gDdQW%a9I)3QxDj5KVz* zw~us4yE}(D?`f3q=*#7494BzD$kRw~Zyb zC1$i!j%=zapbb0yf!{N;=5lkC66@8DWuvqQe>?lGq9KCuH;|pPdeO&h?{6plQUo?_{go^MNJek4+JBY|cc5Y7MGK1M=EU%dmg z6uyX9or0xXJVo~milE`oCl!Ak^Cy0QpVpmDOpJJNCU_U`FJNF8Owxn9_VZe1U%bYB zF>%q}DWQ4Y5pSs;zB&vAhe2f$wQ%^Ls}~%{yI;(Tx z=l_6A12pkV{|gx6{{R#DJ0zPt5x#*whwUCYr3(0^uc>|zW3|HENu ziv3~M6$}{e@F&vvRa0iosQT4uJ$kp+JsxJ{WO zr%^PTpD&OktA6!FwXV1U|F|_OdmY-~xeUlQU-Nbv*QLHRDnzu9&!%swFlkPlj$KNe z5U2A_iN`Um4pyOU(eB;)+9{+X*kSSV#rzd}T z0^PyCl&5f4J*y2}a;@TaPF^LcD~|TfANWtiP>EGbHkjpGVnPFyDeBSV)>~q0N>CUIZ r>=f6M7hCFG5{;hNb{K*ZE%`XOq7e~eba=J90-bVo`c~wqTo~=2OlC~# literal 0 HcmV?d00001 diff --git a/arduino/security/rice-box.go b/arduino/security/rice-box.go index 6429bbebeae..57d4a127c1e 100644 --- a/arduino/security/rice-box.go +++ b/arduino/security/rice-box.go @@ -12,17 +12,24 @@ func init() { // define files file2 := &embedded.EmbeddedFile{ Filename: "arduino_public.gpg.key", - FileModTime: time.Unix(1594040063, 0), + FileModTime: time.Unix(1594311934, 0), Content: string("\x99\x02\r\x04R\xfa\xa2\xfa\x01\x10\x00\xd0\xc5`I2\x11\x17Pb\x8f\x17\x1eNa-Y\x9a\xbe\xa8\xe40\x98\x88\xb9\xb9\xe8|\xcbӪ\xd0\x14\xb2tT\xb0\xaf\b\xe7\xcd\xd0\x19\xdarԒ\xb6ψ*\xd7\xfa\x85q\xe9\x85\xc58X-\xa0\x96\xc3q\xe7\xfc\xd9[q\xbc\x00\xc0\xe9+\xdd\xc2h\x01\xf1\xb1\x1c\x86\x81N\x0e\xa8I\xe5\x97?c\x0f\xc4&\xe6\xa5\xf2b\xc2)\x86\xcbH\x9bS\x04\x00R\x02\xbar\x9dQ\x97%\xe3\xe6\x04,\x91\x99\xc8\xec\xe74\x05+sv\xcf@\xa8dg\x9c5\x94\xc92\x03\xeb\xfb?\x82\xcdB͕o\x96\x17\x92#;L|\x1a(%#`\xf4\x8f\x1dm\x86b\xf2ϓ\xf8}\xb4\n\x990Oa\x82\x8a\xf8\xa3\xeb\a#\x9e\x98F)\xdc\v\x1d\\d\x94ɯ\xb5\xc8\xf8\xb9\xa5?\x13$\xc2T\xa1\xae\xa4͒\x19\xabM\xf8fvS\xac\x9anv\xc3\xdb7Ώ`\xb5F\xf7\x8e\xcaC\xa9\f\xb8*\"x\xa2\x91\xd2\xe9\x8dfu;V\xf0YR\x80\xc6\xe3;'Oc\x18F\x80m\x97D}\xd5\xc9C\x8e~\xc8Wy\xd9\xfa!s\xe0\x88\xceo\xa1V\xe2\x91\xfa\xfdC,O±\xeb%\x1d\xaf\xd1\x89\x028\x04\x13\x01\x02\x00\"\x05\x02R\xfa\xa2\xfa\x02\x1b\x03\x06\v\t\b\a\x03\x02\x06\x15\b\x02\t\n\v\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10{\xaf@L-\xfa\xb4\xae\xf8\t\x0f\xfe ók\xf7\x86֒\x96\x9d\xa2\xec\xfd{\xca9a\xe75\xd3˵X]z\xb0K\xb8\xa0\xb6KdR\x8e\xd7m\xb4u/\xa2E#\xaa\x1e\a\xb6\x9ajf\xcd\xda\xe0t\xa6\xa5r\x80\x02(\x19MՑj\x95k\xf2&\x06\xd8f\xc7\xfd\x81\xf3(x\xe0o\xec \r\xdb\a\x03\xd8\x05\xe1\xa6\x10\x06\xeb\v[\xdb:\xa8\x9c\t[\xb2Y\xbd\x93Ǫ轱\x84h\xa6\xdb\xe3\x0f\x85\xbdj2q\xf5En\xb2+¼靳\xa0Tټ\xa8\xf5b\xc0\x1b\x99\xe6\xbfL!6\xb6'q\xee\xf5L\xb2\xae\x95\xf8\xe2\xfeT2\x84\xc3~\xb7~Q\x04ԙ9\xab\xae\xf3#\xca_\x1af\xcaH\xedB=\xbb:,\xff\x12y,\xcaq\xac\xd1\xe3\x03!\x86\xcc}\x05\xa1>\rf\xa3%\x8eD5'\xaa\xf9!\xb7\xeap\xc6\xcc\x10\xe2\xa5\x1fʴ\xdd\x13\n\x10\xd3қ\x1b\x01\xfbB\a\xefe\x01ө\x18k\xdbe.\xcc\xc9\xf3TY\x9a\x11M\xd3\xf8\x0f\x9e\xd3I:\xc5\x1a\\O\x1f;\xb5\x90I\xee~\xc6\x14\x11\xe9\x0e\x02\xf2w\x89\xe8{\x18\xa8`U\x1d\xfd\xff\xa8p\xe8T/a(\xe1g\xce\x18u\xc5ű\x12\x82Y4{\x85&T\x87\x00k\x17:\xa61\xf1͡\xedƌT\x97\x8e\x1d\x0f\xe3\xb3\x10\xcc\x0fI\xf9\xae\x84\xf3{\x14rC{i\xda\x12[\xafܙ\xaeW\xc2$_pt~\x1e\xfdR\x84\x9c@F\x92G\xcf\x13\xcbg\x9a1\xafG\x00F\x8e\t\xed\x1e\xcf\xe5\xa5?g\xc8\fH\xa0\xb0\xc13O\xae\x96PXM\xfd@j\xda0\xff\xbe\xede\x92V\xd4\t$C+\x02\x9b\xbb$\xce\xf2!\x95Ӊ8\x1f\v\x1e\xb9d\xc6IIB3^t\xa3s\xd8i\xd1\xfb\fyg\xf3\x0fy\xd7\x1a\xb0i)λf\x05\x14\xc2Vr\x84\xbd\x9e\xc3$p\xb2cS\x9b:\xff]?\xba\x9a']Fe\xe6\xb5\x02\xb4\x03\x1bc\xf5\x11\xc1\xdf\xdd\x16\xb6\x17\xa6\xfb\x04oΰ\x18\xa7\xa0\x1c\xef\xb9\x02\r\x04R\xfa\xa2\xfa\x01\x10\x00\xd6\xde\x17G9^\xb3\x83a\x03\xd3\x0f\xa5\xcfU_o\xbc\x98/\xb8\xb0\xfdr8\x9c\xd6隈\xac\xa1\xbc\xbd\x8b\xad5!\x19)\xabZ\xb7\xf6V\xba\x1a\xff\xa8ɥ\xaf\x83Co\xc8\xfe6\xab@4S\xe3\xe6\xecg\x93q\xad\x81e\u007f\xa1PiV\xb1\x16]\x88\x87\xe3\xfb~\xf3f\xef̨.\xe5C\xe0\xb2!p\xd0\x16Jg\x02\xefR\x809\x8a\x90\x1c\xb6&.c\xc0\xae7\x8f\xd8\xca\x19W\xee\xed\x9c䊣ԁ\xbd\x11z,\xa04\x1c>\x16\xfe \xcbj\\10\xa1\x9b6Oel\xdcE\xe2!m\xe7\xac\xfa\xd4)\x96}q\xd1\x01\xca\xde\x10\xbad\xf4\aX\x01\xed.\x9e:2\x93\x11ECEj&#l\xcaE\x9d\xc7p\r.\x9ci+\xadʛ\xa0\xcd\xe7\x18\x9cՔ\xb2\f\xa4\xd1\xf2\np\xb0+\x9bP\xf7\f\xfcov\x97\xb1\xd5\x00p,┒\xc7\xcd(\xc5\xd5UGW\x88\xdd\xe5t\x82\xbc9\xe8FZr\x0e%\x86j\xc91\xd5\xd7\x03\n\xb6\x116\xbfp+%\xbc\x85\nP\x89\xd1\xe6\xf0\xf6\x8b\x8a蔭\xfc<\x92\xbb\x83h\x88\xe3\xdbZ\x94\x04&\xdb\xe7\xbbŽ\xd3\xdd\xd6\xf5\x126'\xd1\xceoф\\\xc6j\x92\x00\x949\x1b\xe7\x83\x06\x9c\xb0WF\xc0\xa5]\xaf\xc8i\xfd\xaf\n\b\xf8\x10\x99\xe4\xf4\xcd\a\xd0\\ri\xc58\xc3A\xcf\x1e۔\x11K\x8c\xd9{D!N\xa5\x8e\xed\xb9?\xabw \x13\xa1\xd7z\b\xb9 \x80\x82\xf9azl\xfe9\xb5o\x00x@lbg\xab\xf5\xcf\x10xě\x1a\xb9\xb6\x0e\xa1E\x13Qψ\x9e\xf7-}ik#\xb2/u;(\x97\x9a\xf1\x027\xb5y\xa3P\xfaU\x96\xa3\xb2\"D\xfa\x91@%b\xaeS\x0e\x81N\xf1\x9a\x9e4H\xf4e\xf7\x8c\x16\"\r\xe0f?{\x97\xc7\xf0\xef\x16)\xe2\xf6Jv\xb2\x1b\xb6\x95\xa3\xdeP[\"\xb0\x9b4Y\xa3\xce!\x80BK\xd6|\x84\x82\xeb\xd5\xeb\xc8\x12\x8f\x98cN\xee\x87\a\x00\x11\x01\x00\x01\x89\x02\x1f\x04\x18\x01\x02\x00\t\x05\x02R\xfa\xa2\xfa\x02\x1b\f\x00\n\t\x10{\xaf@L-\xfa\xb4\xae\x05\v\x10\x00\xc1CN\x8c\xc0\xd6\xf8\xe6\x0e/\xb0\x91\xaa^\xa0Nv\x12\xb2\x9d8#\xe0\x99\x14\xf7\x04\xde\x185\xa7\xb2\x02\xd3\xf6\x19\x18;ӡd9\xbf\xa3\x1aj\xf3Bg.\x8fY\x18C3\xc4\xf5m\x18\xaf;|\xe82oe_|\x8d\xd1Գ\x8a\x19d\xe6\xa4\xd7U\r\x15\x9c\xe1\xb5\xecD\xbc \x91\xb1\t|\xab\xe7$\xc0\xe8Ĕ,,\xf8&r\xe3\xf2\t2\"p\xd131<\xf6\x01\xe0wV\xb7\x05\x94jE#]\xafr\x94\xbc\xd3B\x92ى\xef\xdf\xda/F\xaf\n\xea\xecr\xf5]Ʋ\x94\f|j@\x9b\u007f\xad3T\xd5\xca0\xc3\xe4\xee)\xf9!\x8aV\xef\x8d\u007f\xba*{\xb8\xe60A\x10\xa2\x1d\xf0\xc8Gķa\xcd\xe4\b\xce\x15mS\t\x155\xa8\x00\xc1\xc5\"\xca3\xc7\x11\x05\xb1\x15P\xa1E\xfd\x0eA\xb4d\x14kF\xd4o\b߮\xf9\xb0=1=T\xa1\xe4\xa8.\x87I\x89Z\xb7\x85!ڨ\xe6n\xefo{\x17\xa0\xcaKL\xbf˓w\x13\xb9\x80biUn\xbd\x88\xae\x87\x99n\xfa\xc0\x84jˠ\xd3A/\xc0\xa5\xe9\t#\xc2a\xcdD>Ml\x1a\xe9=\x83\x16i7\xc5\xf6\x06\xa1O\xd7=\xb4\x91\x9a\x0e\xd4\x16Գ\x164 \xf5\u007f\xacΜ\x93G\xbdU\x01\xbe?\xc80G+d\x06\x8e_\xf5\xb0\x9et%\x03\x06%$g \xd2\x16\b\xde\xe8)\xf8N\x83eR\u007fvL\x91ړ7,r\xaa@T\xb4X\x10L\xaf½\xce\xd6=\xc8\x0f6\xe7\xbdK\xe0ӡ\x9e \xe3\xfe\xd9\x0f\x80\xf9\xe1XHS\xb9q\xb8\xe8G\xc2p'\x12;\x9a\xa1\x9c>\x90\xb4\x1b:d==[\xe2\xfc\x13Jڃ\x96\xd0r\xd3~q\x01\xb6L\xe8>\x18\x02\xd0\xd5ݩ\x15\vl!VI\x87\x95\f\x96\x01\xfc!G\xf19ǩ\x90f@\xa0\x889\x81\xb4R\xf2Z\xf7\xa0\xf3/\xaa!H\xecݛ\x04\xb9:\xfc\xed\x00\xf1\x1a\xa0\xe6i\\/\x92gk\x8d\xb9\xe91r\xfdwy\xb9\x02\r\x04S\v\x05\xa7\x01\x10\x00ʡ\xa8\xffK\xf9\xd0\xf0\xac\x9e\xdb\xca;M&\xe3\xe5i\xdf\xea\x044\x1f>j\xce#\xae]\x87\xd6,&\x00\xdf\xf1\v\x10aD\xa1\xb5/\xf8\xb6\x95\xa5\x90\xd6\\h\x1fi\xde\xe4T\x80\f#Q`\xeb\xe3\xfc\x146\x19>\x12x\xd5l\x86⻲\x18{\xea\xac\x1e\x1d\x04\xd4\n9+\x14WG\x1d\x10\xa2\xb6\xbf9\xcd\xf3]\x1a\t\n\x94\x06\xbc\xb0k\xde\xf8:\x12\xa4\x90\xc5\xe1}h\x88J\xd2h`Bf\x9e+E\x8a\xd3\xcc\x03wݩōpp\xce)\xa5>\x0e|\x87ma\xb2\x9a-\xe2\xa9\xd7?\x91M\x0f\xf3\xb0\xe3^.\xd3a\xb6\n\x8c<=L~w\xe1z\x93\x92\x83\xbf\xda.\xc5rZ+\xfa\xac\x18ƦJ\xcb\xecwg`\xd7\bn\xa4+\xd901赟\xb8\xdf\xef\xf7~_\x80\xdb넭\xe7K:o\x9eM\x0f1@\xa8\xd0\xf5v\xed\x00T\x88\x83\xc8Rq\xaa\u007f$P\xd1\x06\x1fV˃\x97\x86\x03\x88aբG;\u007fX\xeb\xc0\r+\xb9\xef\xeb\x1a-\xf6\x12\xa7\xb9\b|2o\xbb\b\xf2\x87\x91\x02%3\x16xBr\x96z\x88`\x89\xd6\x1dZ\xb0\xfd\xb377\xd3_'\u0088j\xbbMN\x88\xf5Aл\xad\x04\xae\xf7\xbd>\xd6j\x12\x82\xb7b\xbdo\x8e\xed\xc3v\as\xb1W\xc1\xa2\xd4\xe4XnC\xb2\x88y\xc5Nu\x99\xf9\xa3N\x15$\xe6\xe7\xf9\xb8\xea\x13\xccZ-\xf5\xc1\x92\n\xf7H3\xed\xde\xc8뚋\xe31\x96p-\xfdem\x81\xac\xbb\xfe:\x10ڈ.\xaa0e\xd9\xc9Gl\n{f\xc1]\x00c\xcbzѢ\xeb1S|\xb4C\xf2\x1b\x81d$6\x94?\xe6\xc4^j\xf9µ\x95\xd4\xdf\xcbd\xb8?,\xa6\xb4\xddSg&\xc6\xecGa\xa3@\xc1\x8e2\xb2\xd7!\x06@\xb9\xab\x1d\x8e!e\xc0\xdd8\xbc\x9f\xd9\xdbj0\xb3\x80\xdf\b\xc3\xf1\x00\x02\xa6co\xdcy\xcd#\x12\xb6\x06\xf5\xf1\x16\xacfV\x18\xa5k\xbeFĔ\xfc~#\xc7\x00\x11\x01\x00\x01\x89\x04>\x04\x18\x01\x02\x00\t\x05\x02S\v\x05\xa7\x02\x1b\x02\x02)\t\x10{\xaf@L-\xfa\xb4\xae\xc1] \x04\x19\x01\x02\x00\x06\x05\x02S\v\x05\xa7\x00\n\t\x10$\xa2k\xad\u007f)B\x91\x87p\x0f\xfe0\xed\x1b|\x96\xb3\x84jdzc\xf9`-(\x86\xf7\x91:\x9cE\x1c1\xe0C\xaduYp$\xd4`\xb5\x9ej`\xa6\xee=X\xe6V\x90\x127\xa2F_\x84\x02\x16\x9a\x81k8\x17\n\xf5P(N\xb4 \xb7\xe8'8mf\x85-h\x12Z'\xfagp\xf19\xee\u007f\xca\xefC\x00\x06s\xb7\xc7\xd1haHw`<\x87ZՓ\xe33\xae\x927\xdbw\x06_\xb87\\鏡\xbf\u007f\xb1s04\xaa\xc6\x1f\x1d#\xa3\xef\xf8fW\x02\xc1\thǙ\x14X\xf8\x8d\x15\x1b4H\xc7\xd93@YC\x1ac\xd3\n\x9c\x8ecj\x99؍\xa8\xdb\x04ˌd\xf1\x18:\xc8s\xff\tB\xef\x95U\xb6\xb3\xf1\x92\xad_\"\x1a\xc9s\u007f\x87\\\xca\xe2\x1e\x88\xecE\xcb5\xe4\f\x0f\xf1\xaa\xf0\xa8\xfeD\x87m\x93\xa90\xa0<Ąj)\x10,\x95o9\xf2\xacX\b̼\xd7\U0010628e\x8e\x8b\x9af\xea\x18\xc2u\xce\xf9\xc3q\xab\x05\x92yn\xd5}uz;\xab1\xff\x8e8\x87\xf6\x04\x1ea\xbd\xa43\xe7\u058c\xb2\xd5\xf2\x8e\x81\xf5xC\xd5\x03-s\xbfg\x11\x9c\x13\u007f\xc4\u038b\xefOp]i\x0eG\xa50\xb1\xa8[\x8bj\t\xa4\xae\x16\xa2\x97<\x11\u05901\xb8\x9b\xe9+\aQ\xdb\u007f\xe7Oo\x1c!\x9c\x8b\x93\xe5Ǝ\xc1@8V\xdf(\xe9n'sz\u007f\xb9\xc8\x0fn\xe9\xecHZ\x06\t\xdcN\xb8\xdfDOa\xc7j\x97\xf3*ߢشxM\xf3\xab\xa4\xde\x1bW\x89K\x9c\xf8\x994\xa1CE\x13\b\xd7<\xf7\x9e̋\U000c2e23O$\xdc3R8\xd857g\xb3c\xf5C-\x9a\x81\xc8O}/\xabn6\xe7\x18\x8f\xa9\x11\x12\n\x90\\g4*\x99bQ\xeb\xec\xac\x13\xbdT:\x9b<,\x06:\xe2\x94\xfd\xd1\\f\xd5ݒ$\xf3\xe962_RW\x00\xf2\x12\x9d\v1Ό\xcdN\xba]\xed\xb8\x9f\n+\xfc\fC\xe72\xf6\x95\x16\x1eO3\xce]\xed\x14\xb1\xe9\x86TT{\x11\x0f\xff|\xbc+\xa5\x13r\x1a\x96\xdd\x18\x96F5\x06\x93C\xfa\x8e\xefMI+\xfaU\xc90\xf9Ǎ\xf1\xf7EO\x1b\xdd@\xf4\xb0Kޟ\x9b\x9a\x99#\xa3\x03\xd9m\f\xbf\xa3a\x92\x1a\xfe\xf1:\xed\t\x8d\f\xf7\x0e\x84\xc0ݲ\fX\x82\x13Q\xd25\x9b\x13\x16q\xaa\xf5\xd2HG\x17\xa4\xca\xf3\x85\xdb\f\xc1\x9f\xbc7\xa3\xfc\x04\xf4\xf3\x87֓L\x1e\x84\xb9\xc1)\x121\xa1Oi\xa1\xbfg\b\x87\\}\xe0\x0e>\xfeS\f[264\xfcXJGl\xad(^\xf1\x10\x80\x11\xd1M\x9d\x18\nu\xa9\xdf\xc96\xaf\xc7\xef\x9el?<\xfe݉H\x94\xce`5\x8eqV\xb3\xa6^\xd7dM\xea4:\x13?]M\xe4\xd3;t(\x10\x86\xa0\xc2\x05\x15\xacAQ\xcf\xed\x93\xc5m\xd5t\xe5x\xfd\xeer\xc4\x11\\%\xca\xec^\xad\x97\xc1G\xf2\u007fN\xaeg\xfe\xff\xea\r\xc1\xcd\xf5\xd66\xac3\x1c\xb7M\xf4w\xc9ópo\x9d\xafP\xc2\xe1:\xc8ތ\xc9\xddҤ|\xe9ΛNJn\xfd\x8f\n\xd2͙\x02\r\x04X\xd13\xbd\x01\x10\x00\xbb\xe7|\xcc?7\x8eA\xe1\xf3\xfa5h\xb3\x04\xc1\x80\"\xfe\x8d\xe4\x8eK6\xb8A\xa3\xeeT\xaf\x90o\x8dKݵ\x81\x8fQ\v5\xe4\xc1\xd1\xea\xe2\x96\xd3\x1eQHM\xd0\xe4\xea\x97İ,\x03N\xcddn\xdd\r\u007fv\xbfQW\x15\x9e\xff\x8a\xdcdD\xde$\xbbܸ\x9fcf\x9c\x89a\x82k\\%qt\xac\xea;~\x86\xc7F\x1eMa\x15\x87\u007f/Mr\xd0\u007f6\xa0>\x9d;\x11B\xa5/+\a2\xba?\x86\x13\xca)\xcc\x01\x95>\xdf\xd2}\xd0P$\xd61\x19\xd1h\xc3X\xa7'\x1d\xe1\xe8\xfbĮ\xa4\xd3K\x90\xadQ\xaa\xe3)\xc8\xd6\xf9\x9a\x88\x94lG\xb9\xfa˨d\x9b\x90.\x95\xb8iw\x18\b\x92\xe30́Yİ\xcc,F\xf4U\xc0\x86T\xb0+\x95+ĥ\xb4\xcc\xc7l\xc1\xe5\xe8\xa68\x13\xe6\xc9K$\xa5\xf2\x1d\x01l\xe0\xa9\xc3I\x94\x18\xf6\xf1[#\xd7\xc4\xcb{2-q\xda\r*\x1b\x86\xc0m\xa6h:\xbeu1vQ\xac\xc3\xd2bLv\x10\x01m\xd7Tx\x81:`\xb1\xe0\u007f\xab\x18s)h\xa5\x03S\xc00\xb9\xdb:\n4\xa9w\xc9\xf6\xa4\xdeg\t\xff3\xab\bZX\xfc\x17F\xa4\xe4\xa9\xc8\xf7\xfc\xd9օ\x16\xf0\x05~}*k]\xb7X̙1?\xb9\xc3O\xb4\xe5\xfa&8&\xa2\xe7<\x92\xda\xf4\xab\x05\x11\xeb7\b\xad\x10s\x0eSTx;\xfb\x13\x90A\xe4\xdcd\x9f\xa8\x10Ώ\x1e&\u0080\xa1k)Vj~g1\x95\x99\x01D^\x0e\x16\xd2SFo\x9f\x98!\xa6\x912\x88]\x84\xe6\f\x92o\xc0\x1f\x9c\a\xd0\x0e\xaf\xd3\xdaUeE\xa9\xaa=\xf2:\xfd\xeaw\xb4qjK\x9c\xe1\xac\x05B\x187\x05:\xe8\xa5qt\u007f\xaa\xaf\xe5\x92A\xd8\"WD[\xe3h\x1e\xd4\xf7ư\xbb\xce\xe5\x1f\x06\f\x04=\x01\xa0\xc9E\x85\xa6e\xb7\xe9B-'#\x04\xb0V\xc0\x00\x8d\xa0\x8c\x91\x14\x0e.ap=֘\xefD2TX\xe2\xa0>\x89\x00\x11\x01\x00\x01\xb0\f\x00\x00gpg\x01\x00\x00\x00\x00\x00\x00\xb4%Arduino Packages \xb0\f\x00\x00gpg\x02\x00\x00\x00\x00\x00\x00\x89\x028\x04\x13\x01\x02\x00\"\x05\x02X\xd13\xbd\x02\x1b\x03\x06\v\t\b\a\x03\x02\x06\x15\b\x02\t\n\v\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10\x95\xfaoC\xe2\x11\x88\xc4\u007fd\x0f\xffk\x8e\v\x9d\x87\f\xd86\x1c\xbf\xf7\x03\x8a\xe1\xc5^a\x10\x1d\xc63ﺬ\xc1\xbb7\xa1\x05\xd0\x1b\xac\x8b>\xdc\xde\x11\x97\"\xe8i\xa0O$\x81n\xf8\\\xcc\x0e\x1f\xedk\"\xa4\x8c\x122\xb7\x1f)5\x9d\x88\x831\x04\xc21\x0eH\x92NI\t\xe7\xf2VR*\xa0\x93w\x89ѺSCS2\xa9o\xf9BD\x1c,\x02a\xa8\xad\x0f\xfau\xb0|\xbb&h\xc0\xaa\x1b0\v/\xe5\x89\xe3\xc3\x06s\x9bc/\xb5\xcaX\xb0\xca#f-\x06o\xbbas;T`\xf1\xae\xf8v\x88,\xc7\xe5\xb9\xfd\xa5\xbaJ׃֡+\xf4>\xf5\x92\xcfSY`\\eN\xd3D]^.Ʒ\xe0\x86\xcf<\x95~\\\xa5\u07bd\x05\x91\xd0y\xa2\x93\xb0f\x9fƏ`\x9b\xdbT\x87\xc7\xf0\x16\xf3\xfam\x9c\x81\xf9\x1c:\xa3z\xf4\xf0\xa4\xa2{\x91&/zg\x18\x18\xdf\x02n\x15\xf2\xb5US_k3\xe6@\x86\xfd`\xa1\xdecpó|\xcf\xe1\xfd\ap\xd85̹\x87\x14#\x1eQw\xadH\x80-$y\xaf\xe0\xd5|\xd3o\xfed36\x14\x82+\x02\b\x12\xb4\x95Hk-\xd9\x1d\xb5\xea(\xb1\xc7;\xbc\x80\x9e\xf5\xcd#\x83:3\r_\xe1us\xae\xc6I\xff\xe0Ԋ\xb8+e.\x13Jo\xf1t\xc7*\x89\x13>\x8a\xcc`\xcb\x06\x87\xc8\x04|I\xf9\xd2RՇ=\xf1\x10k\xec\xceZ\xa9\xe0QY1\xf4%>V̏\xf7\xee\x01\x02\x1b\x8bQԐ\x8d\xf1\x01-%BB\x0f\x86W( w>$\x9d\x1c\x19s\xbe\x89\x84\x96\xb7$\xf6\xaf=Jj\xce\xf1\x92\xf6HK\xbf\xdf\xf8\x84\xe6\xa89\xc2\xe0\xc72\xa56\x8d\x14\x1f;\x10\xe5p\xa8\xdc\x06\xc6x)\x8aސ\xe6\x19~t\x1d\x8fQ\xefD\xa3u\xba-\x11\xd1 \xdb\xc9O\x8a\xe6\v\xc3\xe7\xf8=\xdf\u05ecOxX\x89\x9d$\x9e\x84Ğ}x\vꆂ\x82\xccI\xb0\x06\x00\x03gpg\x00\xb9\x02\r\x04X\xd13\xbd\x01\x10\x00\xd4n\xb0ul\xd8\xebm\x04\xcf(F\x85ᬐQ\xe0ѽ\xf7\xdf\xc3o\xf0\x8b\x8b\xce\x03\xdcq\xae\x10\x10\xb7\x02\xed\x9db(\xd4\xd6j\xdeh\xfe\xd3)\xd3;\xbb\x1d@lBg;\xa9\xb1\x94\x05E_`\xa9Ĕ\xf5\xc2\xe3d\x0fmK\\ՑG\xe8)\"\x04\x89\x84\\\xb1\f>\xcb\xe0\xa4YI\n\xa8Vl\x9f(\xe9\xef\x17\x1e\t\x88\xe4]\xb8\x16!\x96B\xed͟\xfa\x8d\x19E\xfeg\xe2\xdfŹ\xab̔m\x03\xf2A\xdb.\x9cH\xf0\v\xdf\xee\x10\x0fZ\xe2\xbe߀\xb1d\xdbbWA~'\x13T\u007f\x14颎\xa7\x17\x98\xadm|\x8d+c*+\x1a\xfb\xd5H\xac\xfaR\xd5\x02\x83\x17\xf8\xee\xa6\x05\xedJ\xcc|\xc8\x16c\xb1:\x01\xbd?\xe25\x87\fJؾ\xa2\x9a0\xb7\x95?m_*\x9byKiG\t\f.z\xe0X\x17\xeelT(\xad\x81\xac\xb3 \x18\xe4\x8aI\xa7\x82\xe1\xfd\xe0\xcaed[\x93\xf6n\x03\xdanx|Vi\xc9\xd6B\x18?\xfc9w\xack3<\x01\xf0\xf3q\x19\xc8e\xc9(7\xd5B\xaf\x10*W\x84\xb9\xa2@\xf7\xa6\x02ƿA\x1d\x88՟\x02\xe1v;\x98\xcc\b\U001039dc\xe6\xa9<\xc3axAƻ\xcb\xd6\xde)\x04\x02\xa5v\x06\xab\x96Α\x82\b\xac\x9a\xe7\u007f\x1e5\xf5j\x12e\x90\x8c𛇥\xa7Ə\x83\xe4\x16u\"\x8a\x91V\x1e]\xe2l\x8d\x8c\xf8\xcb&\xac\t\xe0\xc3t\x86w>b\x15o\x9c\xb8\xf5\xa4\xa3\x97\xb5/\xf9\xa2\xffZ\f\x99\x95\x83\x88\xa2\xe6\xbf:\x1e!\x83\xf3h\xef)9\xb6\xcdҡD\xa2\xa7\x8e\x05b\xaeK8M\xe0\xed{\x12\xa9s\xc5\xeb+7|\x8e=\x96\xe5w\xf0#\xc6\xf8\xa6o8`\x1c\xfb\xe7\xb3]\xea\xe2\xf1^\x96\xc7A\x14\x9dk\x95\x1dI\xf97\xca\xe0i\xff\x02:ДUV0\x18\fG\x83\xc1vh8\x1e\xd6~Ș\x9b+\xd0uhp\xda\xf8j$t?AI\x1dLK\xe3\xf6l6=_\xb7磚\x03\xf0\x16\xf2@\x9e\xa6݂fO\t*\b\xb7\x90[\x970ȓ\xf5\x86'\xca\xcb\x168\xf6]v\xc8[\xac\x9d\x14\x04\xd4h\xaa\x14!h\x02[P\xd6{\x9e\x13\xa7\xfb\xc2K\xf7\xacvI\x99\xc8\x15\xdf\xf7\xe7ܢ\xa4\x02\x0f\xe0ؑ!\xb3~߈\x04l\xa1\xbd(\x1e\xab\xa8\xf5\v\xf9\xe59\xb6\xb4\"\x1b\x83\xf2\x15\xf8\x11\xcc\x0ev\xcb\xec\x87\xff\x1e\xd2R\xb42\x1e\x1e\xe2\xf3\x01\xcd\x139q\xe2&\xab\xe8F\x1f\xbdh\xc8\x16\xad\x82tW\xfc\xdcp\xd7zE\xf1ϲYy\xfc\xf0\xaf\xf4\xda\xc8\x00\x1c!\x90\x1bSi\xc8\xd2\xcd\xe5.\xa8\x96h\xc6Yӣ\tσ\xb1\xb4x\xe3\xce\xdfj\\ս\xdf\xf5\xa7\x8er\xb0\x06\x00\x03gpg\x00"), } + file3 := &embedded.EmbeddedFile{ + Filename: "board_index_public.gpg.key", + FileModTime: time.Unix(1622554116, 0), + + Content: string("\x99\x01\x8d\x04`\xb6\b\xe6\x01\f\x00\xddђ\x8c\x82\xd0\b\x10\x0f悹\xa5\u05f7iUԇ\x97j\xa3\x8f\xc4\x10k\a\xfe571±L\xee\x13\x01x\x10\xa0_\xf6J?`༁HE\x83\xb6\xaf\xd3nᗞ\x19u\xf2\xe2\xa8\b\xc2\xfe9Z\x92o:\xf6\x99&'.\x80\x15\x92\x8f\xda$]D\x89\xec\xf1\xe1,\xeb\xab\xd4F\xba\x96Lo`ܼ\xd4Z\xed\x9bN\x8cW\xe8_\x18\xe6\xed\xc04\xb6\xbe\xa0\u07b8x\n\xce'\x8aܦ\xaa9e\xa0E\xf3\x8c\xd0\x16i\x8eX\xa74'6\xf89\x8e[Uw\x16\xb4nH\xfd\x1aij\x96\xe5\xd2\x03\xa4:\xe8w\x91<\x9a,\xcb\x1a\xb1R\xeb~\xd9$\xae\xe3䖌\xed\x0f)E\xaf\xadY\x8c\x14u\xfb}++\xbf\xe4h\xaa\x8bZ;\x11\xb9z(ه\xe6\xebZn\x1cB\aI\x81\x14\xcbi\x1c\x04\xd0\x15\xecR\a\x03\x89\xe4q\x8d\x10ߧ\xa5\xf3\t\xb9\x01}\x1c\xddHYI7\x1b\xab\xff\xd33\xeeH\xa2:\x98\xef[\x84Ǣ\x05îhYp\xd41R\xff%Ue\xd4rA\x11\x12\xce\u0aa9_{\x87}\xb8\xd5F\xaam\U000c3552\xdeг\xc9\xff\xd3h\x95\x016͔-\xff\xb4\xe2\x03\xe6Ѝ\n\xae\b\xfd\xd8Dӣ{\n8\a\x8a \x89\xa3\xc0\x0e\t}óaG!H\xc3\xe5I\x15\x96\x83 \xd4s:\u007f5\xc2\xf38\uf44co\x92\x15t\xb8K\xca\xe6ʇ\xd8]\xe2pѪ\xf4\xdbJ\xe5=L\xa7\x00\x11\x01\x00\x01\xb4.Arduino Firmware Uploader \x89\x01\xce\x04\x13\x01\n\x008\x16!\x04\xc7$\xf3\x1a\u007f\xdf\xfc|\x90#\xb65\x82\xf2\xd7\xc7Ţ*s\x05\x02`\xb6\b\xe6\x02\x1b\x03\x05\v\t\b\a\x02\x06\x15\n\t\b\v\x02\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10\x82\xf2\xd7\xc7Ţ*s۱\v\xff^\xa8\t\x03\xff\xd9z\r֒XR\xff:\x9d\u007f\xe8\x1e\xf2J=\xc4\xeaW\xa2\xbb\xeb\xe2}\aƴ\xb6Rز\xe3h\xfa\xb7\xf5\xb7\u007f\xc3~\xef\xe2e7n\x0e\x8b0\xbdp\x8d\x03\u0530\xc4{a\xd3<}o\xb0N\"\xfc\\\x934\x91\xeb\xe8mdDǃ\x91$\x01@\xecwL\xc5\xf7$ϼG\\\v\xd5\xefMv\xdb\xc1\xa2aT\xc0cYB\x9e\x8dr\xed\xbb'\u007f@\xe3\xb6W1O\v\xa3\xb9\xcc\x16v\xe7B\xaf\xacp\xee\xe5a\x11lDTt!\x1f\xb8\xa5\b\xf3\xe8HSH\xafr\xb3\x10\xae\x16m\xed\xa3HV\xea\x05Y\xc5K\x80\xb2\xaf\xdbL\x0fvɂ\x12\x1c#\xedu\x1a\x8c\xf5\n\x99\xfc\xe9\xd0 \xb6lFX\xf87\x8c\xf17c\x8c;\xf9\xa8\xa6C K\xb5\xb0_\xcbǣ\x19ʆ\xec\xa2\xc4\n$\xa0\x0e\x80#ڋEBHm\xec\xa19G\t!\x9a\x8f\\\x9b\xd0E\xc8\f\xb3[\xbfب\xb2\xaf\\\xbf\x93\xb8\x8f4\xf7\xd2\x10\x84\xa8\x132\xd0gٯ#\xa8\xcc{\xf3\x8a\\\b\xea\xdbF\xf8\\\xba\xcd\xc1)\xf0\xba\x00zO`\x80\xf2\xa0\x81\x10rsW\xcf\x1e\xd6\x11\xfb\xe8\x9a\xcb\xf0\x87\xa8\xb3a\xcfgI\x98\xccE\xcf\x1a\x11y\x06\xcb\xc9\xe34\bs\xdaw\x05J$(\x1b\xe0\xe6\xabNč1\xa4XB\x13\xc1\x13\xd76\x85\xf8O\xad\x96\x03\xe7R<ɽ\x8d\x8eٓ\x91&\x81\xb1-\xf9\x1by6ʵ\xff\x17\xa6\xb2w\xb9\x01\x8d\x04`\xb6\b\xe6\x01\f\x00ݿ\xd8;z\xf9\xe2d\xfe\xfb\xc7\x16=}D\xbcz\x9c< U|\xc7\xc96\x12?G\x83\xa8\x04\\\xc2n5\xb7p9e\xa6\xb9TIQ\x8f\xf1WJԻ>\xcaV(\x92\x98\xe29\xf9r\xd9U9fG\x92\x93\xfb\xe6t[\xb7k\xf1s:\xf2#\x91(\\0\xad\x1a\x03~-\xc5U\x95\x13\x9e\xe2p\a;\xb1\x1a\x90\xec\xc5|Ob\xfa\\Q\x15\xd44\x12ɛq1\x96Ɵ\xfb\x86S\xb9\x8b\x9f\x8b\xb0; 6`\u007f\xf5\x01\xaf\\ݖ\x0e4W\xd5\xddi@2\rf+\xe0\xf4\xe78\xdfR\x15\xaemt\x85\xfb\xe8\xd9Q>\x92\xfc\xd9\xf0C\x9f\xc6-&\x0f\x8el(\v\xa5\xb4pNE\xb3\x97Ku\x1d\x99^\xa2\v4\xf9\xe9B\xb9\xec$\xa0\xd5;f\xb8x\x97x43瀨Qiz\x04\x94S{\x137<.\xbe\x03\xddu\xdc \xe1\xd5\x12\x8aJ\x88:\xc2\xca\f:\x1c\x94\xd3$\xac\xd0hr\xea\x1c\xfc\xb0\xfc\xd2\xd2\xce_\xe5\xd2\xec\x19k\xdbG\x12GG\x82qbS\xda5F\xf6c\xd1fG~zd\x85s\x95\xc1wƢ_f7\xb9#T\xca'\x8c\xa2\x99\xcc\xf5\xc0\xc3\a~\xe60\xa3]\r\x125\x93\x11G\xd7{f\x9f=GYh\a\xf8K\xe2\xc8G\xba9\xf7\xe9V\x83U3ŝD\x87\xba:\u007fj\xec\x1dM估{\xc9\x11lۯ\x14\x1c\xb35\t\xf2|\x02\x05\xfcD]\x02\x98\x15\v\x12G\xc0\xa0\xc5\xe1\xd87\x14\xa1\x00\x11\x01\x00\x01\x89\x01\xb6\x04\x18\x01\n\x00 \x16!\x04\xc7$\xf3\x1a\u007f\xdf\xfc|\x90#\xb65\x82\xf2\xd7\xc7Ţ*s\x05\x02`\xb6\b\xe6\x02\x1b\f\x00\n\t\x10\x82\xf2\xd7\xc7Ţ*sO\x95\f\x00\xc9\xc4T\xeb\xc2\x1e&\xa6\x1c\x1f\xfd\x87g\bB-\x99\x93\xa7;d\rl\xdc!'ó\xe9=\x96S\xf7\x8e)GH\a\xcc79\x00\xf5\xdc])\xb0L\xddߋ\xd3\xdc\t\x81\xc0\xa8\x98\xe0JiF\xa8E\xect_\xfc^\xcd\xccH\xf5ڥ+\f\x90\xec۞r\xe7\x98[\x1f\xde\x0e\xdeo\bt\xe1厑U\xe3\xc1F\xc10i3\xf7CHx\x185\xd4R\xe1\xae\x12\x90\xed\xad\x8d\x01s\xa5I5FQ4\xce\xdbh\x02\a\xbb'\xe5\x1e1\x9aϗ\x97\x05\x82\x1b.*\xfb+\xb0\x9e\xb2a\x84\xbay\x8f\xe4\t\xb2`\xdf\x01\x8fI\xe3dV\xd18\xa2\x9c@\x99 \xb8\x92\xff\xd6M(ŨV\xe5\xbe\xf1\x96~\n\xe5\xbf^\x9f_\xf9\xa8\xb0\x12\xa66J\xbcd\xba\xa4Vo\xbenO\xe0,\x81\xeb\u007f!\x81\x8a6\x1c}9\x16B\x06y\xba\x89\xbb\xbc\xbe\x9aEVDNa\xb3\x83\xf6\x86\t\xeda\x9c!\x96\xe6\xe1`\xad>Y\x93L~\xed\xfb\x9d\x82.&\xd1g\x863\x1ef\x8e_m4\xa3Ť\\%\xd7@\xfb\xec\x92\xda'g\x88/\xe5\xe0\x18\xa3\xb9ַy\x8a\xd1b\x1c\xcc\xd7bR2~\f`B\x8d\xf2\x9e\xc3>\xc1\xe4\x12\\\x8cn:j\x8a\xfe\x1c\xf1\b%\xd4\x06\x1a\xccŎ\u007f\x95\xcc\xdc\x1b\x94\x06\xa7\x18\xbf\x88\v\xe2\x85Z\x9f\x9b\xe9.\xc0\x13\xb4`H\xbc\x12 \x96z\x15\x84n\xa6\xb4 {@\xf7*\xc1\xa6:\x85*\xd6Mx\xcf\x1et\xa8"), + } // define dirs dir1 := &embedded.EmbeddedDir{ Filename: "", - DirModTime: time.Unix(1594040685, 0), + DirModTime: time.Unix(1622554116, 0), ChildFiles: []*embedded.EmbeddedFile{ file2, // "arduino_public.gpg.key" + file3, // "board_index_public.gpg.key" }, } @@ -33,12 +40,13 @@ func init() { // register embeddedBox embedded.RegisterEmbeddedBox(`keys`, &embedded.EmbeddedBox{ Name: `keys`, - Time: time.Unix(1594040685, 0), + Time: time.Unix(1622554116, 0), Dirs: map[string]*embedded.EmbeddedDir{ "": dir1, }, Files: map[string]*embedded.EmbeddedFile{ - "arduino_public.gpg.key": file2, + "arduino_public.gpg.key": file2, + "board_index_public.gpg.key": file3, }, }) } From 27d37385c6c1b4224cd938d034b9d4ef993a5df6 Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Tue, 1 Jun 2021 16:21:01 +0200 Subject: [PATCH 2/5] add new function to allow the usage of another gpg key --- arduino/security/signatures.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/arduino/security/signatures.go b/arduino/security/signatures.go index fad37435027..49b75be4822 100644 --- a/arduino/security/signatures.go +++ b/arduino/security/signatures.go @@ -29,11 +29,20 @@ import ( // fails this function returns false. The PGP entity in the trusted keychain that // produced the signature is returned too. func VerifyArduinoDetachedSignature(targetPath *paths.Path, signaturePath *paths.Path) (bool, *openpgp.Entity, error) { + return VerifyDetachedSignature(targetPath, signaturePath, paths.New("arduino_public.gpg.key")) +} + +// VerifyDetachedSignature checks that the detached GPG signature (in the +// signaturePath file) matches the given targetPath file and is an authentic +// signature from the bundled trusted keychain. the keyPath is the path of the public key used. +// If any of the above conditions fails this function returns false. +// The PGP entity in the trusted keychain that produced the signature is returned too. +func VerifyDetachedSignature(targetPath *paths.Path, signaturePath *paths.Path, keyPath *paths.Path) (bool, *openpgp.Entity, error) { keysBox, err := rice.FindBox("keys") if err != nil { panic("could not find bundled signature keys") } - arduinoKeyringFile, err := keysBox.Open("arduino_public.gpg.key") + arduinoKeyringFile, err := keysBox.Open(keyPath.String()) if err != nil { panic("could not find bundled signature keys") } From 7bd403f1d66f4f67f4ba5dc52ffdc04a22617881 Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Tue, 1 Jun 2021 16:21:25 +0200 Subject: [PATCH 3/5] add new test and enhance existing ones --- arduino/security/signature_test.go | 28 +- arduino/security/testdata/board_index.json | 455 ++++++++++++++++++ .../security/testdata/board_index.json.sig | Bin 0 -> 438 bytes 3 files changed, 480 insertions(+), 3 deletions(-) create mode 100644 arduino/security/testdata/board_index.json create mode 100644 arduino/security/testdata/board_index.json.sig diff --git a/arduino/security/signature_test.go b/arduino/security/signature_test.go index dc97e86c363..44349b52b72 100644 --- a/arduino/security/signature_test.go +++ b/arduino/security/signature_test.go @@ -22,14 +22,36 @@ import ( "github.com/stretchr/testify/require" ) -func TestSignatureVerification(t *testing.T) { - res, signer, err := VerifyArduinoDetachedSignature(paths.New("testdata/package_index.json"), paths.New("testdata/package_index.json.sig")) +var ( + PackageIndexPath = paths.New("testdata/package_index.json") + PackageSignaturePath = paths.New("testdata/package_index.json.sig") + BoardIndexPath = paths.New("testdata/board_index.json") + BoardSignaturePath = paths.New("testdata/board_index.json.sig") + BoardKey = paths.New("board_index_public.gpg.key") + InvalidIndexPath = paths.New("testdata/invalid_file.json") +) + +func TestVerifyArduinoDetachedSignature(t *testing.T) { + res, signer, err := VerifyArduinoDetachedSignature(PackageIndexPath, PackageSignaturePath) require.NoError(t, err) require.NotNil(t, signer) require.True(t, res) require.Equal(t, uint64(0x7baf404c2dfab4ae), signer.PrimaryKey.KeyId) - res, signer, err = VerifyArduinoDetachedSignature(paths.New("testdata/invalid_file.json"), paths.New("testdata/package_index.json.sig")) + res, signer, err = VerifyArduinoDetachedSignature(InvalidIndexPath, PackageSignaturePath) + require.False(t, res) + require.Nil(t, signer) + require.Error(t, err) +} + +func TestVerifyDetachedSignature(t *testing.T) { + res, signer, err := VerifyDetachedSignature(BoardIndexPath, BoardSignaturePath, BoardKey) + require.NoError(t, err) + require.NotNil(t, signer) + require.True(t, res) + require.Equal(t, uint64(0x82f2d7c7c5a22a73), signer.PrimaryKey.KeyId) + + res, signer, err = VerifyDetachedSignature(InvalidIndexPath, PackageSignaturePath, BoardKey) require.False(t, res) require.Nil(t, signer) require.Error(t, err) diff --git a/arduino/security/testdata/board_index.json b/arduino/security/testdata/board_index.json new file mode 100644 index 00000000000..3850373429d --- /dev/null +++ b/arduino/security/testdata/board_index.json @@ -0,0 +1,455 @@ +[ + { + "fqbn": "arduino:samd:mkr1000", + "firmware": [ + { + "version": "19.4.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/WINC1500/19.4.4/m2m_aio_3a0.bin", + "checksum": "SHA-256:f8be2a5ef10e109f685b7550d211ed11c07487de430b0e5994ca557160116c27", + "size": "412308" + }, + { + "version": "19.5.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/WINC1500/19.5.2/m2m_aio_3a0.bin", + "checksum": "SHA-256:e2e5aa2cf185745582002e2fed27c079d4228bc8d756281f43638c72061c9110", + "size": "413604" + }, + { + "version": "19.5.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/WINC1500/19.5.4/m2m_aio_3a0.bin", + "checksum": "SHA-256:146d3d5fccf65ff6d732e34077e56f1f0b2f69584fd8499db914ea11ed463042", + "size": "413604" + }, + { + "version": "19.6.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/WINC1500/19.6.1/m2m_aio_3a0.bin", + "checksum": "SHA-256:629a2553cb738be1424eaa707c00403ebce179fdb94008acec1f185a19a60c81", + "size": "359356" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.samd.mkr1000/loader.bin", + "checksum": "SHA-256:1d904bf745c8df448358d70837a36ee8dec4c2a01e0e3b2ef8ef51c6a6c9d385", + "size": "16328" + }, + "module": "WINC1500", + "name": "Arduino MKR1000", + "uploader": "arduino:bossac@1.7.0-arduino3", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "true", + "uploader.command": "\"{uploader}\" -i -d --port={serial.port.file} -U true -i -e -w -v \"{loader.sketch}.bin\" -R" + }, + { + "fqbn": "arduino:samd:mkrwifi1010", + "firmware": [ + { + "version": "1.0.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.0.0/NINA_W102.bin", + "checksum": "SHA-256:3fe2cd90a0774e271624d42ab1b238d92c7495648e9918ad49dea3b20379905e", + "size": "736256" + }, + { + "version": "1.1.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.1.0/NINA_W102.bin", + "checksum": "SHA-256:3b38f44a2e2e2d28995973f432bc2795f7c58a14e8638f55e3f024ffa499bcf8", + "size": "814080" + }, + { + "version": "1.2.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.1/NINA_W102.bin", + "checksum": "SHA-256:3121bf4074fce0248946810c4d03f5d3fb1296cd4667aeb801b5d066e1b07ff3", + "size": "880640" + }, + { + "version": "1.2.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.2/NINA_W102.bin", + "checksum": "SHA-256:71d0a49a4d79aa46dff6f434383133b4365581407846d709fbd961e2b770eb3c", + "size": "893952" + }, + { + "version": "1.2.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.3/NINA_W102.bin", + "checksum": "SHA-256:9c908f33cc05831972833a274f65baf84da35c61fc081856959211ae3504c899", + "size": "893952" + }, + { + "version": "1.2.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.4/NINA_W102.bin", + "checksum": "SHA-256:8b9c07abdaa5647c47466aa3c575e743495a295fd8db2fe91b7e28fe4135ffad", + "size": "917504" + }, + { + "version": "1.3.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.3.0/NINA_W102.bin", + "checksum": "SHA-256:aa37c920df18aabc6544df93c64bea6b3b97841b68ff4a6a53d2b800b265d2b5", + "size": "986112" + }, + { + "version": "1.4.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.0/NINA_W102.bin", + "checksum": "SHA-256:ca5ed0b5efd727dd3c507f39a744e171ce690ef17b116c0571f18d1fea17aa85", + "size": "1035264" + }, + { + "version": "1.4.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.1/NINA_W102.bin", + "checksum": "SHA-256:b20f213bc886a95556fc5cec5003c7ebc617da83581ba20fb9f96db003063bbd", + "size": "1208320" + }, + { + "version": "1.4.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.2/NINA_W102.bin", + "checksum": "SHA-256:61d0acbd3d2eeb45b6971448d9537f7c4fa27f264e20970ad5dfdd4cbfdd8ee0", + "size": "1125376" + }, + { + "version": "1.4.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.3/NINA_W102.bin", + "checksum": "SHA-256:8c10c3ee3b8fb2ade3a650b41a3081566fc160e89b32e5d0ee040e63647692b8", + "size": "1125376" + }, + { + "version": "1.4.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.4/NINA_W102.bin", + "checksum": "SHA-256:c8678e00ab9b2dc99cdc45ef577b77498dac802c3f5b99961da190374fddcef8", + "size": "1125376" + }, + { + "version": "1.4.5", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.5/NINA_W102.bin", + "checksum": "SHA-256:7c2814c8f879e62d234d7ac3a9c28f9a2d1e1dbc3569bd740761ca796247a4c9", + "size": "1127424" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.samd.mkrwifi1010/loader.bin", + "checksum": "SHA-256:a4f9b0586bf78b8e1c5a6660df6b749d1ad4e3ee79ee4928371a465899a4a1c4", + "size": "13688" + }, + "module": "NINA", + "name": "Arduino MKR WiFi 1010", + "uploader": "arduino:bossac@1.7.0-arduino3", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "true", + "uploader.command": "\"{uploader}\" -i -d --port={serial.port.file} -U true -i -e -w -v \"{loader.sketch}.bin\" -R" + }, + { + "fqbn": "arduino:samd:nano_33_iot", + "firmware": [ + { + "version": "1.0.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.0.0/NINA_W102.bin", + "checksum": "SHA-256:3fe2cd90a0774e271624d42ab1b238d92c7495648e9918ad49dea3b20379905e", + "size": "736256" + }, + { + "version": "1.1.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.1.0/NINA_W102.bin", + "checksum": "SHA-256:3b38f44a2e2e2d28995973f432bc2795f7c58a14e8638f55e3f024ffa499bcf8", + "size": "814080" + }, + { + "version": "1.2.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.1/NINA_W102.bin", + "checksum": "SHA-256:3121bf4074fce0248946810c4d03f5d3fb1296cd4667aeb801b5d066e1b07ff3", + "size": "880640" + }, + { + "version": "1.2.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.2/NINA_W102.bin", + "checksum": "SHA-256:71d0a49a4d79aa46dff6f434383133b4365581407846d709fbd961e2b770eb3c", + "size": "893952" + }, + { + "version": "1.2.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.3/NINA_W102.bin", + "checksum": "SHA-256:9c908f33cc05831972833a274f65baf84da35c61fc081856959211ae3504c899", + "size": "893952" + }, + { + "version": "1.2.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.4/NINA_W102.bin", + "checksum": "SHA-256:8b9c07abdaa5647c47466aa3c575e743495a295fd8db2fe91b7e28fe4135ffad", + "size": "917504" + }, + { + "version": "1.3.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.3.0/NINA_W102.bin", + "checksum": "SHA-256:aa37c920df18aabc6544df93c64bea6b3b97841b68ff4a6a53d2b800b265d2b5", + "size": "986112" + }, + { + "version": "1.4.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.0/NINA_W102.bin", + "checksum": "SHA-256:ca5ed0b5efd727dd3c507f39a744e171ce690ef17b116c0571f18d1fea17aa85", + "size": "1035264" + }, + { + "version": "1.4.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.1/NINA_W102.bin", + "checksum": "SHA-256:b20f213bc886a95556fc5cec5003c7ebc617da83581ba20fb9f96db003063bbd", + "size": "1208320" + }, + { + "version": "1.4.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.2/NINA_W102.bin", + "checksum": "SHA-256:61d0acbd3d2eeb45b6971448d9537f7c4fa27f264e20970ad5dfdd4cbfdd8ee0", + "size": "1125376" + }, + { + "version": "1.4.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.3/NINA_W102.bin", + "checksum": "SHA-256:8c10c3ee3b8fb2ade3a650b41a3081566fc160e89b32e5d0ee040e63647692b8", + "size": "1125376" + }, + { + "version": "1.4.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.4/NINA_W102.bin", + "checksum": "SHA-256:c8678e00ab9b2dc99cdc45ef577b77498dac802c3f5b99961da190374fddcef8", + "size": "1125376" + }, + { + "version": "1.4.5", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.5/NINA_W102.bin", + "checksum": "SHA-256:7c2814c8f879e62d234d7ac3a9c28f9a2d1e1dbc3569bd740761ca796247a4c9", + "size": "1127424" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.samd.nano_33_iot/loader.bin", + "checksum": "SHA-256:f643fd763ba6aec835bb708669a6a5f5709357990d9eab6f4e6d5223ea3ca2a3", + "size": "14348" + }, + "module": "NINA", + "name": "Arduino NANO 33 IoT", + "uploader": "arduino:bossac@1.7.0-arduino3", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "true", + "uploader.command": "\"{uploader}\" -i -d --port={serial.port.file} -U true -i -e -w -v \"{loader.sketch}.bin\" -R" + }, + { + "fqbn": "arduino:samd:mkrvidor4000", + "firmware": [ + { + "version": "1.0.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.0.0/NINA_W102.bin", + "checksum": "SHA-256:3fe2cd90a0774e271624d42ab1b238d92c7495648e9918ad49dea3b20379905e", + "size": "736256" + }, + { + "version": "1.1.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.1.0/NINA_W102.bin", + "checksum": "SHA-256:3b38f44a2e2e2d28995973f432bc2795f7c58a14e8638f55e3f024ffa499bcf8", + "size": "814080" + }, + { + "version": "1.2.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.1/NINA_W102.bin", + "checksum": "SHA-256:3121bf4074fce0248946810c4d03f5d3fb1296cd4667aeb801b5d066e1b07ff3", + "size": "880640" + }, + { + "version": "1.2.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.2/NINA_W102.bin", + "checksum": "SHA-256:71d0a49a4d79aa46dff6f434383133b4365581407846d709fbd961e2b770eb3c", + "size": "893952" + }, + { + "version": "1.2.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.3/NINA_W102.bin", + "checksum": "SHA-256:9c908f33cc05831972833a274f65baf84da35c61fc081856959211ae3504c899", + "size": "893952" + }, + { + "version": "1.2.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.4/NINA_W102.bin", + "checksum": "SHA-256:8b9c07abdaa5647c47466aa3c575e743495a295fd8db2fe91b7e28fe4135ffad", + "size": "917504" + }, + { + "version": "1.3.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.3.0/NINA_W102.bin", + "checksum": "SHA-256:aa37c920df18aabc6544df93c64bea6b3b97841b68ff4a6a53d2b800b265d2b5", + "size": "986112" + }, + { + "version": "1.4.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.0/NINA_W102.bin", + "checksum": "SHA-256:ca5ed0b5efd727dd3c507f39a744e171ce690ef17b116c0571f18d1fea17aa85", + "size": "1035264" + }, + { + "version": "1.4.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.1/NINA_W102.bin", + "checksum": "SHA-256:b20f213bc886a95556fc5cec5003c7ebc617da83581ba20fb9f96db003063bbd", + "size": "1208320" + }, + { + "version": "1.4.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.2/NINA_W102.bin", + "checksum": "SHA-256:61d0acbd3d2eeb45b6971448d9537f7c4fa27f264e20970ad5dfdd4cbfdd8ee0", + "size": "1125376" + }, + { + "version": "1.4.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.3/NINA_W102.bin", + "checksum": "SHA-256:8c10c3ee3b8fb2ade3a650b41a3081566fc160e89b32e5d0ee040e63647692b8", + "size": "1125376" + }, + { + "version": "1.4.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.4/NINA_W102.bin", + "checksum": "SHA-256:c8678e00ab9b2dc99cdc45ef577b77498dac802c3f5b99961da190374fddcef8", + "size": "1125376" + }, + { + "version": "1.4.5", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.5/NINA_W102.bin", + "checksum": "SHA-256:7c2814c8f879e62d234d7ac3a9c28f9a2d1e1dbc3569bd740761ca796247a4c9", + "size": "1127424" + } + ], + "module": "NINA", + "name": "Arduino MKR Vidor 4000", + "uploader": "arduino:bossac@1.7.0-arduino3", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "true", + "uploader.command": "\"{uploader}\" -i -d --port={serial.port.file} -I -U true -i -e -w \"{loader.sketch}.bin\" -R" + }, + { + "fqbn": "arduino:megaavr:uno2018", + "firmware": [ + { + "version": "1.2.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.1/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:bac23326dd4c3b6358ee88ff322da8c16e24e9917b8b0bbd18f663aacfb758cf", + "size": "880640" + }, + { + "version": "1.2.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.2/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:d1f496b185eff6b2ab2f839f6673afc80e1b3e3b2056fc8d9290a74895baf0e5", + "size": "893952" + }, + { + "version": "1.2.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.3/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:53668eb76be80fffdd67ced7cbb8ab231638b9ee428ae83568dfe48359008bb4", + "size": "893952" + }, + { + "version": "1.2.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.2.4/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:37b042cf759b52a96304c35af6a066038184533cc6256f795e92ed1b4fbda3d5", + "size": "917504" + }, + { + "version": "1.3.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.3.0/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:c538028f428b3fc219d2f7c0d9debacd07bababf43dbc28680ed452225ff4629", + "size": "986112" + }, + { + "version": "1.4.0", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.0/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:fe852e28eb0547a324069194dcce524b5a9f18adce2983bbe11a818a7ae8200a", + "size": "1041408" + }, + { + "version": "1.4.1", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.1/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:f11deb8ce5abe908353eebca7253c18359eb8ea2a601908d5cdb56bf035b4158", + "size": "1044480" + }, + { + "version": "1.4.2", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.2/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:7adff887267297dccc6c3ce77f41a986a23a1f7dfce9e8f3b70b3aa038371d47", + "size": "1132544" + }, + { + "version": "1.4.3", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.3/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:c026f967bd3add27716a1afaf729d669a5e093771098329bab2477980d6879b5", + "size": "1132544" + }, + { + "version": "1.4.4", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.4/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:6b7809357a57946638b271dd1b0b43a84cbcbea9b854d3ff093752fa0fe7b818", + "size": "1132544" + }, + { + "version": "1.4.5", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.5/NINA_W102-Uno_WiFi_Rev2.bin", + "checksum": "SHA-256:b641c4f6f76ab4c7a529848da54f15b9b9857a9627920129a0a6f65edc465c67", + "size": "1133568" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.megaavr.uno2018/loader.hex", + "checksum": "SHA-256:0d4c2bf93da575245e92595b1d0f55db1fa79583f1c3361646da051dab020afe", + "size": "18954" + }, + "module": "NINA", + "name": "Arduino Uno WiFi Rev2", + "uploader": "arduino:avrdude@6.3.0-arduino17", + "uploader.command": "\"{uploader}\" \"-C{config.path}\" -v -patmega4809 -cxplainedmini_updi -Pusb -b115200 -e -D \"-Uflash:w:{loader.sketch}.hex:i\" \"-Ufuse2:w:0x01:m\" \"-Ufuse5:w:0xC9:m\" \"-Ufuse8:w:0x02:m\" " + }, + { + "fqbn": "arduino:samd:mkrnb1500", + "firmware": [ + { + "version": "5.6A2.00-to-5.6A2.01", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/SARA/5.6A2.00-to-5.6A2.01/5.6A2.00-to-5.6A2.01.pkg", + "checksum": "SHA-256:8f04bd7fa1833cf2d3762e086d79191e76bf66c6e108e852b5fe89ca4f2b72c9", + "size": "529880" + }, + { + "version": "5.6A2_01_to_99", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/SARA/5.6A2_01_to_99/5.6A2_01_to_99.pkg", + "checksum": "SHA-256:abb947accdeb980d7aeafed45ac7ce797eb90445eeb8d0bd57ca5b3ad204dbf6", + "size": "1738" + }, + { + "version": "99_to_5.6A2_01", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/SARA/99_to_5.6A2_01/99_to_5.6A2_01.pkg", + "checksum": "SHA-256:81618148c677d8c36df5089c931b46476f4a78fd9d9fd231fee0a9dbb38aa970", + "size": "1724" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.samd.mkrnb1500/loader.bin", + "checksum": "SHA-256:a627ff76588626eacaaec2a2f5719e3fcf069fda2b32f8ace4f2703f1768f142", + "size": "11312" + }, + "module": "SARA", + "name": "Arduino MKR NB 1500", + "uploader": "arduino:bossac@1.7.0-arduino3", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "true", + "uploader.command": "\"{uploader}\" -i -d --port={serial.port.file} -U true -i -e -w -v \"{loader.sketch}.bin\" -R" + }, + { + "fqbn": "arduino:mbed_nano:nanorp2040connect", + "firmware": [ + { + "version": "1.4.5", + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/NINA/1.4.5/NINA_W102-Nano_RP2040_Connect.bin", + "checksum": "SHA-256:5cc391414abd2233001923221a0103dd5ca37222cf885dace065962c962ccd2b", + "size": "1127424" + } + ], + "loader_sketch": { + "url": "https://downloads.arduino.cc/arduino-fwuploader/firmwares/loader/arduino.mbed_nano.nanorp2040connect/loader.elf", + "checksum": "SHA-256:263fe2389f9a4ee3ba5938f2115faad3bbb9c775821a598a66f0f1708e64fc01", + "size": "1649504" + }, + "module": "NINA", + "name": "Arduino Nano RP2040 Connect", + "uploader": "arduino:rp2040tools@1.0.2", + "upload.use_1200bps_touch": "true", + "upload.wait_for_upload_port": "false", + "uploader.command": "\"{uploader}\" -v -D \"{loader.sketch}.elf\"" + } +] \ No newline at end of file diff --git a/arduino/security/testdata/board_index.json.sig b/arduino/security/testdata/board_index.json.sig new file mode 100644 index 0000000000000000000000000000000000000000..c2bce9ecbdc662568bbdf9732e348cd4e99ab49e GIT binary patch literal 438 zcmV;n0ZIOe0kZ@E0SW*e79j-3B=Z`7-~4=#Bepey^4G`3qAGI*0${c;TL20P5Q6g8 z$Hk&5bNZhQ0FXm3L;&77tUL+!e)b%VkBcl;!8#N|j+1&7cxl6orNN7eBf;)9c;>+J znowp9TvWTT#H13N7TqjP^3DqyryL9LK-aXIwd7bpMk_aBG#K9rp}N}a907rj6&qX? zf|>&Ey;0`M3>U86j)Eh2+Kn0bB1#g;;)s{E6r1{IKZx@ z+Pq}O1X*xr$x2ZD;CHz^nrkbq!gXTws2%y zdf0A}mxj&^1$O9(IyZe)vfIOXs4GOg)EN%cJ$X-mcQ}EWRDsV1fu+yv+xL}d&{mrO gs>H;(APl?YIA$qGCTydQoLIJA_oNaFnR2_6vv5q;E&u=k literal 0 HcmV?d00001 From 9d713caaf0ce74c6b125f6d708ab7139ad786fbf Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Tue, 1 Jun 2021 18:27:59 +0200 Subject: [PATCH 4/5] apply suggestions by @cmaglie --- ...y => module_firmware_index_public.gpg.key} | Bin arduino/security/rice-box.go | 16 +++------ arduino/security/signature_test.go | 6 ++-- arduino/security/signatures.go | 33 +++++++++++++----- ..._index.json => module_firmware_index.json} | 0 ...son.sig => module_firmware_index.json.sig} | Bin 6 files changed, 31 insertions(+), 24 deletions(-) rename arduino/security/keys/{board_index_public.gpg.key => module_firmware_index_public.gpg.key} (100%) rename arduino/security/testdata/{board_index.json => module_firmware_index.json} (100%) rename arduino/security/testdata/{board_index.json.sig => module_firmware_index.json.sig} (100%) diff --git a/arduino/security/keys/board_index_public.gpg.key b/arduino/security/keys/module_firmware_index_public.gpg.key similarity index 100% rename from arduino/security/keys/board_index_public.gpg.key rename to arduino/security/keys/module_firmware_index_public.gpg.key diff --git a/arduino/security/rice-box.go b/arduino/security/rice-box.go index 57d4a127c1e..6429bbebeae 100644 --- a/arduino/security/rice-box.go +++ b/arduino/security/rice-box.go @@ -12,24 +12,17 @@ func init() { // define files file2 := &embedded.EmbeddedFile{ Filename: "arduino_public.gpg.key", - FileModTime: time.Unix(1594311934, 0), + FileModTime: time.Unix(1594040063, 0), Content: string("\x99\x02\r\x04R\xfa\xa2\xfa\x01\x10\x00\xd0\xc5`I2\x11\x17Pb\x8f\x17\x1eNa-Y\x9a\xbe\xa8\xe40\x98\x88\xb9\xb9\xe8|\xcbӪ\xd0\x14\xb2tT\xb0\xaf\b\xe7\xcd\xd0\x19\xdarԒ\xb6ψ*\xd7\xfa\x85q\xe9\x85\xc58X-\xa0\x96\xc3q\xe7\xfc\xd9[q\xbc\x00\xc0\xe9+\xdd\xc2h\x01\xf1\xb1\x1c\x86\x81N\x0e\xa8I\xe5\x97?c\x0f\xc4&\xe6\xa5\xf2b\xc2)\x86\xcbH\x9bS\x04\x00R\x02\xbar\x9dQ\x97%\xe3\xe6\x04,\x91\x99\xc8\xec\xe74\x05+sv\xcf@\xa8dg\x9c5\x94\xc92\x03\xeb\xfb?\x82\xcdB͕o\x96\x17\x92#;L|\x1a(%#`\xf4\x8f\x1dm\x86b\xf2ϓ\xf8}\xb4\n\x990Oa\x82\x8a\xf8\xa3\xeb\a#\x9e\x98F)\xdc\v\x1d\\d\x94ɯ\xb5\xc8\xf8\xb9\xa5?\x13$\xc2T\xa1\xae\xa4͒\x19\xabM\xf8fvS\xac\x9anv\xc3\xdb7Ώ`\xb5F\xf7\x8e\xcaC\xa9\f\xb8*\"x\xa2\x91\xd2\xe9\x8dfu;V\xf0YR\x80\xc6\xe3;'Oc\x18F\x80m\x97D}\xd5\xc9C\x8e~\xc8Wy\xd9\xfa!s\xe0\x88\xceo\xa1V\xe2\x91\xfa\xfdC,O±\xeb%\x1d\xaf\xd1\x89\x028\x04\x13\x01\x02\x00\"\x05\x02R\xfa\xa2\xfa\x02\x1b\x03\x06\v\t\b\a\x03\x02\x06\x15\b\x02\t\n\v\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10{\xaf@L-\xfa\xb4\xae\xf8\t\x0f\xfe ók\xf7\x86֒\x96\x9d\xa2\xec\xfd{\xca9a\xe75\xd3˵X]z\xb0K\xb8\xa0\xb6KdR\x8e\xd7m\xb4u/\xa2E#\xaa\x1e\a\xb6\x9ajf\xcd\xda\xe0t\xa6\xa5r\x80\x02(\x19MՑj\x95k\xf2&\x06\xd8f\xc7\xfd\x81\xf3(x\xe0o\xec \r\xdb\a\x03\xd8\x05\xe1\xa6\x10\x06\xeb\v[\xdb:\xa8\x9c\t[\xb2Y\xbd\x93Ǫ轱\x84h\xa6\xdb\xe3\x0f\x85\xbdj2q\xf5En\xb2+¼靳\xa0Tټ\xa8\xf5b\xc0\x1b\x99\xe6\xbfL!6\xb6'q\xee\xf5L\xb2\xae\x95\xf8\xe2\xfeT2\x84\xc3~\xb7~Q\x04ԙ9\xab\xae\xf3#\xca_\x1af\xcaH\xedB=\xbb:,\xff\x12y,\xcaq\xac\xd1\xe3\x03!\x86\xcc}\x05\xa1>\rf\xa3%\x8eD5'\xaa\xf9!\xb7\xeap\xc6\xcc\x10\xe2\xa5\x1fʴ\xdd\x13\n\x10\xd3қ\x1b\x01\xfbB\a\xefe\x01ө\x18k\xdbe.\xcc\xc9\xf3TY\x9a\x11M\xd3\xf8\x0f\x9e\xd3I:\xc5\x1a\\O\x1f;\xb5\x90I\xee~\xc6\x14\x11\xe9\x0e\x02\xf2w\x89\xe8{\x18\xa8`U\x1d\xfd\xff\xa8p\xe8T/a(\xe1g\xce\x18u\xc5ű\x12\x82Y4{\x85&T\x87\x00k\x17:\xa61\xf1͡\xedƌT\x97\x8e\x1d\x0f\xe3\xb3\x10\xcc\x0fI\xf9\xae\x84\xf3{\x14rC{i\xda\x12[\xafܙ\xaeW\xc2$_pt~\x1e\xfdR\x84\x9c@F\x92G\xcf\x13\xcbg\x9a1\xafG\x00F\x8e\t\xed\x1e\xcf\xe5\xa5?g\xc8\fH\xa0\xb0\xc13O\xae\x96PXM\xfd@j\xda0\xff\xbe\xede\x92V\xd4\t$C+\x02\x9b\xbb$\xce\xf2!\x95Ӊ8\x1f\v\x1e\xb9d\xc6IIB3^t\xa3s\xd8i\xd1\xfb\fyg\xf3\x0fy\xd7\x1a\xb0i)λf\x05\x14\xc2Vr\x84\xbd\x9e\xc3$p\xb2cS\x9b:\xff]?\xba\x9a']Fe\xe6\xb5\x02\xb4\x03\x1bc\xf5\x11\xc1\xdf\xdd\x16\xb6\x17\xa6\xfb\x04oΰ\x18\xa7\xa0\x1c\xef\xb9\x02\r\x04R\xfa\xa2\xfa\x01\x10\x00\xd6\xde\x17G9^\xb3\x83a\x03\xd3\x0f\xa5\xcfU_o\xbc\x98/\xb8\xb0\xfdr8\x9c\xd6隈\xac\xa1\xbc\xbd\x8b\xad5!\x19)\xabZ\xb7\xf6V\xba\x1a\xff\xa8ɥ\xaf\x83Co\xc8\xfe6\xab@4S\xe3\xe6\xecg\x93q\xad\x81e\u007f\xa1PiV\xb1\x16]\x88\x87\xe3\xfb~\xf3f\xef̨.\xe5C\xe0\xb2!p\xd0\x16Jg\x02\xefR\x809\x8a\x90\x1c\xb6&.c\xc0\xae7\x8f\xd8\xca\x19W\xee\xed\x9c䊣ԁ\xbd\x11z,\xa04\x1c>\x16\xfe \xcbj\\10\xa1\x9b6Oel\xdcE\xe2!m\xe7\xac\xfa\xd4)\x96}q\xd1\x01\xca\xde\x10\xbad\xf4\aX\x01\xed.\x9e:2\x93\x11ECEj&#l\xcaE\x9d\xc7p\r.\x9ci+\xadʛ\xa0\xcd\xe7\x18\x9cՔ\xb2\f\xa4\xd1\xf2\np\xb0+\x9bP\xf7\f\xfcov\x97\xb1\xd5\x00p,┒\xc7\xcd(\xc5\xd5UGW\x88\xdd\xe5t\x82\xbc9\xe8FZr\x0e%\x86j\xc91\xd5\xd7\x03\n\xb6\x116\xbfp+%\xbc\x85\nP\x89\xd1\xe6\xf0\xf6\x8b\x8a蔭\xfc<\x92\xbb\x83h\x88\xe3\xdbZ\x94\x04&\xdb\xe7\xbbŽ\xd3\xdd\xd6\xf5\x126'\xd1\xceoф\\\xc6j\x92\x00\x949\x1b\xe7\x83\x06\x9c\xb0WF\xc0\xa5]\xaf\xc8i\xfd\xaf\n\b\xf8\x10\x99\xe4\xf4\xcd\a\xd0\\ri\xc58\xc3A\xcf\x1e۔\x11K\x8c\xd9{D!N\xa5\x8e\xed\xb9?\xabw \x13\xa1\xd7z\b\xb9 \x80\x82\xf9azl\xfe9\xb5o\x00x@lbg\xab\xf5\xcf\x10xě\x1a\xb9\xb6\x0e\xa1E\x13Qψ\x9e\xf7-}ik#\xb2/u;(\x97\x9a\xf1\x027\xb5y\xa3P\xfaU\x96\xa3\xb2\"D\xfa\x91@%b\xaeS\x0e\x81N\xf1\x9a\x9e4H\xf4e\xf7\x8c\x16\"\r\xe0f?{\x97\xc7\xf0\xef\x16)\xe2\xf6Jv\xb2\x1b\xb6\x95\xa3\xdeP[\"\xb0\x9b4Y\xa3\xce!\x80BK\xd6|\x84\x82\xeb\xd5\xeb\xc8\x12\x8f\x98cN\xee\x87\a\x00\x11\x01\x00\x01\x89\x02\x1f\x04\x18\x01\x02\x00\t\x05\x02R\xfa\xa2\xfa\x02\x1b\f\x00\n\t\x10{\xaf@L-\xfa\xb4\xae\x05\v\x10\x00\xc1CN\x8c\xc0\xd6\xf8\xe6\x0e/\xb0\x91\xaa^\xa0Nv\x12\xb2\x9d8#\xe0\x99\x14\xf7\x04\xde\x185\xa7\xb2\x02\xd3\xf6\x19\x18;ӡd9\xbf\xa3\x1aj\xf3Bg.\x8fY\x18C3\xc4\xf5m\x18\xaf;|\xe82oe_|\x8d\xd1Գ\x8a\x19d\xe6\xa4\xd7U\r\x15\x9c\xe1\xb5\xecD\xbc \x91\xb1\t|\xab\xe7$\xc0\xe8Ĕ,,\xf8&r\xe3\xf2\t2\"p\xd131<\xf6\x01\xe0wV\xb7\x05\x94jE#]\xafr\x94\xbc\xd3B\x92ى\xef\xdf\xda/F\xaf\n\xea\xecr\xf5]Ʋ\x94\f|j@\x9b\u007f\xad3T\xd5\xca0\xc3\xe4\xee)\xf9!\x8aV\xef\x8d\u007f\xba*{\xb8\xe60A\x10\xa2\x1d\xf0\xc8Gķa\xcd\xe4\b\xce\x15mS\t\x155\xa8\x00\xc1\xc5\"\xca3\xc7\x11\x05\xb1\x15P\xa1E\xfd\x0eA\xb4d\x14kF\xd4o\b߮\xf9\xb0=1=T\xa1\xe4\xa8.\x87I\x89Z\xb7\x85!ڨ\xe6n\xefo{\x17\xa0\xcaKL\xbf˓w\x13\xb9\x80biUn\xbd\x88\xae\x87\x99n\xfa\xc0\x84jˠ\xd3A/\xc0\xa5\xe9\t#\xc2a\xcdD>Ml\x1a\xe9=\x83\x16i7\xc5\xf6\x06\xa1O\xd7=\xb4\x91\x9a\x0e\xd4\x16Գ\x164 \xf5\u007f\xacΜ\x93G\xbdU\x01\xbe?\xc80G+d\x06\x8e_\xf5\xb0\x9et%\x03\x06%$g \xd2\x16\b\xde\xe8)\xf8N\x83eR\u007fvL\x91ړ7,r\xaa@T\xb4X\x10L\xaf½\xce\xd6=\xc8\x0f6\xe7\xbdK\xe0ӡ\x9e \xe3\xfe\xd9\x0f\x80\xf9\xe1XHS\xb9q\xb8\xe8G\xc2p'\x12;\x9a\xa1\x9c>\x90\xb4\x1b:d==[\xe2\xfc\x13Jڃ\x96\xd0r\xd3~q\x01\xb6L\xe8>\x18\x02\xd0\xd5ݩ\x15\vl!VI\x87\x95\f\x96\x01\xfc!G\xf19ǩ\x90f@\xa0\x889\x81\xb4R\xf2Z\xf7\xa0\xf3/\xaa!H\xecݛ\x04\xb9:\xfc\xed\x00\xf1\x1a\xa0\xe6i\\/\x92gk\x8d\xb9\xe91r\xfdwy\xb9\x02\r\x04S\v\x05\xa7\x01\x10\x00ʡ\xa8\xffK\xf9\xd0\xf0\xac\x9e\xdb\xca;M&\xe3\xe5i\xdf\xea\x044\x1f>j\xce#\xae]\x87\xd6,&\x00\xdf\xf1\v\x10aD\xa1\xb5/\xf8\xb6\x95\xa5\x90\xd6\\h\x1fi\xde\xe4T\x80\f#Q`\xeb\xe3\xfc\x146\x19>\x12x\xd5l\x86⻲\x18{\xea\xac\x1e\x1d\x04\xd4\n9+\x14WG\x1d\x10\xa2\xb6\xbf9\xcd\xf3]\x1a\t\n\x94\x06\xbc\xb0k\xde\xf8:\x12\xa4\x90\xc5\xe1}h\x88J\xd2h`Bf\x9e+E\x8a\xd3\xcc\x03wݩōpp\xce)\xa5>\x0e|\x87ma\xb2\x9a-\xe2\xa9\xd7?\x91M\x0f\xf3\xb0\xe3^.\xd3a\xb6\n\x8c<=L~w\xe1z\x93\x92\x83\xbf\xda.\xc5rZ+\xfa\xac\x18ƦJ\xcb\xecwg`\xd7\bn\xa4+\xd901赟\xb8\xdf\xef\xf7~_\x80\xdb넭\xe7K:o\x9eM\x0f1@\xa8\xd0\xf5v\xed\x00T\x88\x83\xc8Rq\xaa\u007f$P\xd1\x06\x1fV˃\x97\x86\x03\x88aբG;\u007fX\xeb\xc0\r+\xb9\xef\xeb\x1a-\xf6\x12\xa7\xb9\b|2o\xbb\b\xf2\x87\x91\x02%3\x16xBr\x96z\x88`\x89\xd6\x1dZ\xb0\xfd\xb377\xd3_'\u0088j\xbbMN\x88\xf5Aл\xad\x04\xae\xf7\xbd>\xd6j\x12\x82\xb7b\xbdo\x8e\xed\xc3v\as\xb1W\xc1\xa2\xd4\xe4XnC\xb2\x88y\xc5Nu\x99\xf9\xa3N\x15$\xe6\xe7\xf9\xb8\xea\x13\xccZ-\xf5\xc1\x92\n\xf7H3\xed\xde\xc8뚋\xe31\x96p-\xfdem\x81\xac\xbb\xfe:\x10ڈ.\xaa0e\xd9\xc9Gl\n{f\xc1]\x00c\xcbzѢ\xeb1S|\xb4C\xf2\x1b\x81d$6\x94?\xe6\xc4^j\xf9µ\x95\xd4\xdf\xcbd\xb8?,\xa6\xb4\xddSg&\xc6\xecGa\xa3@\xc1\x8e2\xb2\xd7!\x06@\xb9\xab\x1d\x8e!e\xc0\xdd8\xbc\x9f\xd9\xdbj0\xb3\x80\xdf\b\xc3\xf1\x00\x02\xa6co\xdcy\xcd#\x12\xb6\x06\xf5\xf1\x16\xacfV\x18\xa5k\xbeFĔ\xfc~#\xc7\x00\x11\x01\x00\x01\x89\x04>\x04\x18\x01\x02\x00\t\x05\x02S\v\x05\xa7\x02\x1b\x02\x02)\t\x10{\xaf@L-\xfa\xb4\xae\xc1] \x04\x19\x01\x02\x00\x06\x05\x02S\v\x05\xa7\x00\n\t\x10$\xa2k\xad\u007f)B\x91\x87p\x0f\xfe0\xed\x1b|\x96\xb3\x84jdzc\xf9`-(\x86\xf7\x91:\x9cE\x1c1\xe0C\xaduYp$\xd4`\xb5\x9ej`\xa6\xee=X\xe6V\x90\x127\xa2F_\x84\x02\x16\x9a\x81k8\x17\n\xf5P(N\xb4 \xb7\xe8'8mf\x85-h\x12Z'\xfagp\xf19\xee\u007f\xca\xefC\x00\x06s\xb7\xc7\xd1haHw`<\x87ZՓ\xe33\xae\x927\xdbw\x06_\xb87\\鏡\xbf\u007f\xb1s04\xaa\xc6\x1f\x1d#\xa3\xef\xf8fW\x02\xc1\thǙ\x14X\xf8\x8d\x15\x1b4H\xc7\xd93@YC\x1ac\xd3\n\x9c\x8ecj\x99؍\xa8\xdb\x04ˌd\xf1\x18:\xc8s\xff\tB\xef\x95U\xb6\xb3\xf1\x92\xad_\"\x1a\xc9s\u007f\x87\\\xca\xe2\x1e\x88\xecE\xcb5\xe4\f\x0f\xf1\xaa\xf0\xa8\xfeD\x87m\x93\xa90\xa0<Ąj)\x10,\x95o9\xf2\xacX\b̼\xd7\U0010628e\x8e\x8b\x9af\xea\x18\xc2u\xce\xf9\xc3q\xab\x05\x92yn\xd5}uz;\xab1\xff\x8e8\x87\xf6\x04\x1ea\xbd\xa43\xe7\u058c\xb2\xd5\xf2\x8e\x81\xf5xC\xd5\x03-s\xbfg\x11\x9c\x13\u007f\xc4\u038b\xefOp]i\x0eG\xa50\xb1\xa8[\x8bj\t\xa4\xae\x16\xa2\x97<\x11\u05901\xb8\x9b\xe9+\aQ\xdb\u007f\xe7Oo\x1c!\x9c\x8b\x93\xe5Ǝ\xc1@8V\xdf(\xe9n'sz\u007f\xb9\xc8\x0fn\xe9\xecHZ\x06\t\xdcN\xb8\xdfDOa\xc7j\x97\xf3*ߢشxM\xf3\xab\xa4\xde\x1bW\x89K\x9c\xf8\x994\xa1CE\x13\b\xd7<\xf7\x9e̋\U000c2e23O$\xdc3R8\xd857g\xb3c\xf5C-\x9a\x81\xc8O}/\xabn6\xe7\x18\x8f\xa9\x11\x12\n\x90\\g4*\x99bQ\xeb\xec\xac\x13\xbdT:\x9b<,\x06:\xe2\x94\xfd\xd1\\f\xd5ݒ$\xf3\xe962_RW\x00\xf2\x12\x9d\v1Ό\xcdN\xba]\xed\xb8\x9f\n+\xfc\fC\xe72\xf6\x95\x16\x1eO3\xce]\xed\x14\xb1\xe9\x86TT{\x11\x0f\xff|\xbc+\xa5\x13r\x1a\x96\xdd\x18\x96F5\x06\x93C\xfa\x8e\xefMI+\xfaU\xc90\xf9Ǎ\xf1\xf7EO\x1b\xdd@\xf4\xb0Kޟ\x9b\x9a\x99#\xa3\x03\xd9m\f\xbf\xa3a\x92\x1a\xfe\xf1:\xed\t\x8d\f\xf7\x0e\x84\xc0ݲ\fX\x82\x13Q\xd25\x9b\x13\x16q\xaa\xf5\xd2HG\x17\xa4\xca\xf3\x85\xdb\f\xc1\x9f\xbc7\xa3\xfc\x04\xf4\xf3\x87֓L\x1e\x84\xb9\xc1)\x121\xa1Oi\xa1\xbfg\b\x87\\}\xe0\x0e>\xfeS\f[264\xfcXJGl\xad(^\xf1\x10\x80\x11\xd1M\x9d\x18\nu\xa9\xdf\xc96\xaf\xc7\xef\x9el?<\xfe݉H\x94\xce`5\x8eqV\xb3\xa6^\xd7dM\xea4:\x13?]M\xe4\xd3;t(\x10\x86\xa0\xc2\x05\x15\xacAQ\xcf\xed\x93\xc5m\xd5t\xe5x\xfd\xeer\xc4\x11\\%\xca\xec^\xad\x97\xc1G\xf2\u007fN\xaeg\xfe\xff\xea\r\xc1\xcd\xf5\xd66\xac3\x1c\xb7M\xf4w\xc9ópo\x9d\xafP\xc2\xe1:\xc8ތ\xc9\xddҤ|\xe9ΛNJn\xfd\x8f\n\xd2͙\x02\r\x04X\xd13\xbd\x01\x10\x00\xbb\xe7|\xcc?7\x8eA\xe1\xf3\xfa5h\xb3\x04\xc1\x80\"\xfe\x8d\xe4\x8eK6\xb8A\xa3\xeeT\xaf\x90o\x8dKݵ\x81\x8fQ\v5\xe4\xc1\xd1\xea\xe2\x96\xd3\x1eQHM\xd0\xe4\xea\x97İ,\x03N\xcddn\xdd\r\u007fv\xbfQW\x15\x9e\xff\x8a\xdcdD\xde$\xbbܸ\x9fcf\x9c\x89a\x82k\\%qt\xac\xea;~\x86\xc7F\x1eMa\x15\x87\u007f/Mr\xd0\u007f6\xa0>\x9d;\x11B\xa5/+\a2\xba?\x86\x13\xca)\xcc\x01\x95>\xdf\xd2}\xd0P$\xd61\x19\xd1h\xc3X\xa7'\x1d\xe1\xe8\xfbĮ\xa4\xd3K\x90\xadQ\xaa\xe3)\xc8\xd6\xf9\x9a\x88\x94lG\xb9\xfa˨d\x9b\x90.\x95\xb8iw\x18\b\x92\xe30́Yİ\xcc,F\xf4U\xc0\x86T\xb0+\x95+ĥ\xb4\xcc\xc7l\xc1\xe5\xe8\xa68\x13\xe6\xc9K$\xa5\xf2\x1d\x01l\xe0\xa9\xc3I\x94\x18\xf6\xf1[#\xd7\xc4\xcb{2-q\xda\r*\x1b\x86\xc0m\xa6h:\xbeu1vQ\xac\xc3\xd2bLv\x10\x01m\xd7Tx\x81:`\xb1\xe0\u007f\xab\x18s)h\xa5\x03S\xc00\xb9\xdb:\n4\xa9w\xc9\xf6\xa4\xdeg\t\xff3\xab\bZX\xfc\x17F\xa4\xe4\xa9\xc8\xf7\xfc\xd9օ\x16\xf0\x05~}*k]\xb7X̙1?\xb9\xc3O\xb4\xe5\xfa&8&\xa2\xe7<\x92\xda\xf4\xab\x05\x11\xeb7\b\xad\x10s\x0eSTx;\xfb\x13\x90A\xe4\xdcd\x9f\xa8\x10Ώ\x1e&\u0080\xa1k)Vj~g1\x95\x99\x01D^\x0e\x16\xd2SFo\x9f\x98!\xa6\x912\x88]\x84\xe6\f\x92o\xc0\x1f\x9c\a\xd0\x0e\xaf\xd3\xdaUeE\xa9\xaa=\xf2:\xfd\xeaw\xb4qjK\x9c\xe1\xac\x05B\x187\x05:\xe8\xa5qt\u007f\xaa\xaf\xe5\x92A\xd8\"WD[\xe3h\x1e\xd4\xf7ư\xbb\xce\xe5\x1f\x06\f\x04=\x01\xa0\xc9E\x85\xa6e\xb7\xe9B-'#\x04\xb0V\xc0\x00\x8d\xa0\x8c\x91\x14\x0e.ap=֘\xefD2TX\xe2\xa0>\x89\x00\x11\x01\x00\x01\xb0\f\x00\x00gpg\x01\x00\x00\x00\x00\x00\x00\xb4%Arduino Packages \xb0\f\x00\x00gpg\x02\x00\x00\x00\x00\x00\x00\x89\x028\x04\x13\x01\x02\x00\"\x05\x02X\xd13\xbd\x02\x1b\x03\x06\v\t\b\a\x03\x02\x06\x15\b\x02\t\n\v\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10\x95\xfaoC\xe2\x11\x88\xc4\u007fd\x0f\xffk\x8e\v\x9d\x87\f\xd86\x1c\xbf\xf7\x03\x8a\xe1\xc5^a\x10\x1d\xc63ﺬ\xc1\xbb7\xa1\x05\xd0\x1b\xac\x8b>\xdc\xde\x11\x97\"\xe8i\xa0O$\x81n\xf8\\\xcc\x0e\x1f\xedk\"\xa4\x8c\x122\xb7\x1f)5\x9d\x88\x831\x04\xc21\x0eH\x92NI\t\xe7\xf2VR*\xa0\x93w\x89ѺSCS2\xa9o\xf9BD\x1c,\x02a\xa8\xad\x0f\xfau\xb0|\xbb&h\xc0\xaa\x1b0\v/\xe5\x89\xe3\xc3\x06s\x9bc/\xb5\xcaX\xb0\xca#f-\x06o\xbbas;T`\xf1\xae\xf8v\x88,\xc7\xe5\xb9\xfd\xa5\xbaJ׃֡+\xf4>\xf5\x92\xcfSY`\\eN\xd3D]^.Ʒ\xe0\x86\xcf<\x95~\\\xa5\u07bd\x05\x91\xd0y\xa2\x93\xb0f\x9fƏ`\x9b\xdbT\x87\xc7\xf0\x16\xf3\xfam\x9c\x81\xf9\x1c:\xa3z\xf4\xf0\xa4\xa2{\x91&/zg\x18\x18\xdf\x02n\x15\xf2\xb5US_k3\xe6@\x86\xfd`\xa1\xdecpó|\xcf\xe1\xfd\ap\xd85̹\x87\x14#\x1eQw\xadH\x80-$y\xaf\xe0\xd5|\xd3o\xfed36\x14\x82+\x02\b\x12\xb4\x95Hk-\xd9\x1d\xb5\xea(\xb1\xc7;\xbc\x80\x9e\xf5\xcd#\x83:3\r_\xe1us\xae\xc6I\xff\xe0Ԋ\xb8+e.\x13Jo\xf1t\xc7*\x89\x13>\x8a\xcc`\xcb\x06\x87\xc8\x04|I\xf9\xd2RՇ=\xf1\x10k\xec\xceZ\xa9\xe0QY1\xf4%>V̏\xf7\xee\x01\x02\x1b\x8bQԐ\x8d\xf1\x01-%BB\x0f\x86W( w>$\x9d\x1c\x19s\xbe\x89\x84\x96\xb7$\xf6\xaf=Jj\xce\xf1\x92\xf6HK\xbf\xdf\xf8\x84\xe6\xa89\xc2\xe0\xc72\xa56\x8d\x14\x1f;\x10\xe5p\xa8\xdc\x06\xc6x)\x8aސ\xe6\x19~t\x1d\x8fQ\xefD\xa3u\xba-\x11\xd1 \xdb\xc9O\x8a\xe6\v\xc3\xe7\xf8=\xdf\u05ecOxX\x89\x9d$\x9e\x84Ğ}x\vꆂ\x82\xccI\xb0\x06\x00\x03gpg\x00\xb9\x02\r\x04X\xd13\xbd\x01\x10\x00\xd4n\xb0ul\xd8\xebm\x04\xcf(F\x85ᬐQ\xe0ѽ\xf7\xdf\xc3o\xf0\x8b\x8b\xce\x03\xdcq\xae\x10\x10\xb7\x02\xed\x9db(\xd4\xd6j\xdeh\xfe\xd3)\xd3;\xbb\x1d@lBg;\xa9\xb1\x94\x05E_`\xa9Ĕ\xf5\xc2\xe3d\x0fmK\\ՑG\xe8)\"\x04\x89\x84\\\xb1\f>\xcb\xe0\xa4YI\n\xa8Vl\x9f(\xe9\xef\x17\x1e\t\x88\xe4]\xb8\x16!\x96B\xed͟\xfa\x8d\x19E\xfeg\xe2\xdfŹ\xab̔m\x03\xf2A\xdb.\x9cH\xf0\v\xdf\xee\x10\x0fZ\xe2\xbe߀\xb1d\xdbbWA~'\x13T\u007f\x14颎\xa7\x17\x98\xadm|\x8d+c*+\x1a\xfb\xd5H\xac\xfaR\xd5\x02\x83\x17\xf8\xee\xa6\x05\xedJ\xcc|\xc8\x16c\xb1:\x01\xbd?\xe25\x87\fJؾ\xa2\x9a0\xb7\x95?m_*\x9byKiG\t\f.z\xe0X\x17\xeelT(\xad\x81\xac\xb3 \x18\xe4\x8aI\xa7\x82\xe1\xfd\xe0\xcaed[\x93\xf6n\x03\xdanx|Vi\xc9\xd6B\x18?\xfc9w\xack3<\x01\xf0\xf3q\x19\xc8e\xc9(7\xd5B\xaf\x10*W\x84\xb9\xa2@\xf7\xa6\x02ƿA\x1d\x88՟\x02\xe1v;\x98\xcc\b\U001039dc\xe6\xa9<\xc3axAƻ\xcb\xd6\xde)\x04\x02\xa5v\x06\xab\x96Α\x82\b\xac\x9a\xe7\u007f\x1e5\xf5j\x12e\x90\x8c𛇥\xa7Ə\x83\xe4\x16u\"\x8a\x91V\x1e]\xe2l\x8d\x8c\xf8\xcb&\xac\t\xe0\xc3t\x86w>b\x15o\x9c\xb8\xf5\xa4\xa3\x97\xb5/\xf9\xa2\xffZ\f\x99\x95\x83\x88\xa2\xe6\xbf:\x1e!\x83\xf3h\xef)9\xb6\xcdҡD\xa2\xa7\x8e\x05b\xaeK8M\xe0\xed{\x12\xa9s\xc5\xeb+7|\x8e=\x96\xe5w\xf0#\xc6\xf8\xa6o8`\x1c\xfb\xe7\xb3]\xea\xe2\xf1^\x96\xc7A\x14\x9dk\x95\x1dI\xf97\xca\xe0i\xff\x02:ДUV0\x18\fG\x83\xc1vh8\x1e\xd6~Ș\x9b+\xd0uhp\xda\xf8j$t?AI\x1dLK\xe3\xf6l6=_\xb7磚\x03\xf0\x16\xf2@\x9e\xa6݂fO\t*\b\xb7\x90[\x970ȓ\xf5\x86'\xca\xcb\x168\xf6]v\xc8[\xac\x9d\x14\x04\xd4h\xaa\x14!h\x02[P\xd6{\x9e\x13\xa7\xfb\xc2K\xf7\xacvI\x99\xc8\x15\xdf\xf7\xe7ܢ\xa4\x02\x0f\xe0ؑ!\xb3~߈\x04l\xa1\xbd(\x1e\xab\xa8\xf5\v\xf9\xe59\xb6\xb4\"\x1b\x83\xf2\x15\xf8\x11\xcc\x0ev\xcb\xec\x87\xff\x1e\xd2R\xb42\x1e\x1e\xe2\xf3\x01\xcd\x139q\xe2&\xab\xe8F\x1f\xbdh\xc8\x16\xad\x82tW\xfc\xdcp\xd7zE\xf1ϲYy\xfc\xf0\xaf\xf4\xda\xc8\x00\x1c!\x90\x1bSi\xc8\xd2\xcd\xe5.\xa8\x96h\xc6Yӣ\tσ\xb1\xb4x\xe3\xce\xdfj\\ս\xdf\xf5\xa7\x8er\xb0\x06\x00\x03gpg\x00"), } - file3 := &embedded.EmbeddedFile{ - Filename: "board_index_public.gpg.key", - FileModTime: time.Unix(1622554116, 0), - - Content: string("\x99\x01\x8d\x04`\xb6\b\xe6\x01\f\x00\xddђ\x8c\x82\xd0\b\x10\x0f悹\xa5\u05f7iUԇ\x97j\xa3\x8f\xc4\x10k\a\xfe571±L\xee\x13\x01x\x10\xa0_\xf6J?`༁HE\x83\xb6\xaf\xd3nᗞ\x19u\xf2\xe2\xa8\b\xc2\xfe9Z\x92o:\xf6\x99&'.\x80\x15\x92\x8f\xda$]D\x89\xec\xf1\xe1,\xeb\xab\xd4F\xba\x96Lo`ܼ\xd4Z\xed\x9bN\x8cW\xe8_\x18\xe6\xed\xc04\xb6\xbe\xa0\u07b8x\n\xce'\x8aܦ\xaa9e\xa0E\xf3\x8c\xd0\x16i\x8eX\xa74'6\xf89\x8e[Uw\x16\xb4nH\xfd\x1aij\x96\xe5\xd2\x03\xa4:\xe8w\x91<\x9a,\xcb\x1a\xb1R\xeb~\xd9$\xae\xe3䖌\xed\x0f)E\xaf\xadY\x8c\x14u\xfb}++\xbf\xe4h\xaa\x8bZ;\x11\xb9z(ه\xe6\xebZn\x1cB\aI\x81\x14\xcbi\x1c\x04\xd0\x15\xecR\a\x03\x89\xe4q\x8d\x10ߧ\xa5\xf3\t\xb9\x01}\x1c\xddHYI7\x1b\xab\xff\xd33\xeeH\xa2:\x98\xef[\x84Ǣ\x05îhYp\xd41R\xff%Ue\xd4rA\x11\x12\xce\u0aa9_{\x87}\xb8\xd5F\xaam\U000c3552\xdeг\xc9\xff\xd3h\x95\x016͔-\xff\xb4\xe2\x03\xe6Ѝ\n\xae\b\xfd\xd8Dӣ{\n8\a\x8a \x89\xa3\xc0\x0e\t}óaG!H\xc3\xe5I\x15\x96\x83 \xd4s:\u007f5\xc2\xf38\uf44co\x92\x15t\xb8K\xca\xe6ʇ\xd8]\xe2pѪ\xf4\xdbJ\xe5=L\xa7\x00\x11\x01\x00\x01\xb4.Arduino Firmware Uploader \x89\x01\xce\x04\x13\x01\n\x008\x16!\x04\xc7$\xf3\x1a\u007f\xdf\xfc|\x90#\xb65\x82\xf2\xd7\xc7Ţ*s\x05\x02`\xb6\b\xe6\x02\x1b\x03\x05\v\t\b\a\x02\x06\x15\n\t\b\v\x02\x04\x16\x02\x03\x01\x02\x1e\x01\x02\x17\x80\x00\n\t\x10\x82\xf2\xd7\xc7Ţ*s۱\v\xff^\xa8\t\x03\xff\xd9z\r֒XR\xff:\x9d\u007f\xe8\x1e\xf2J=\xc4\xeaW\xa2\xbb\xeb\xe2}\aƴ\xb6Rز\xe3h\xfa\xb7\xf5\xb7\u007f\xc3~\xef\xe2e7n\x0e\x8b0\xbdp\x8d\x03\u0530\xc4{a\xd3<}o\xb0N\"\xfc\\\x934\x91\xeb\xe8mdDǃ\x91$\x01@\xecwL\xc5\xf7$ϼG\\\v\xd5\xefMv\xdb\xc1\xa2aT\xc0cYB\x9e\x8dr\xed\xbb'\u007f@\xe3\xb6W1O\v\xa3\xb9\xcc\x16v\xe7B\xaf\xacp\xee\xe5a\x11lDTt!\x1f\xb8\xa5\b\xf3\xe8HSH\xafr\xb3\x10\xae\x16m\xed\xa3HV\xea\x05Y\xc5K\x80\xb2\xaf\xdbL\x0fvɂ\x12\x1c#\xedu\x1a\x8c\xf5\n\x99\xfc\xe9\xd0 \xb6lFX\xf87\x8c\xf17c\x8c;\xf9\xa8\xa6C K\xb5\xb0_\xcbǣ\x19ʆ\xec\xa2\xc4\n$\xa0\x0e\x80#ڋEBHm\xec\xa19G\t!\x9a\x8f\\\x9b\xd0E\xc8\f\xb3[\xbfب\xb2\xaf\\\xbf\x93\xb8\x8f4\xf7\xd2\x10\x84\xa8\x132\xd0gٯ#\xa8\xcc{\xf3\x8a\\\b\xea\xdbF\xf8\\\xba\xcd\xc1)\xf0\xba\x00zO`\x80\xf2\xa0\x81\x10rsW\xcf\x1e\xd6\x11\xfb\xe8\x9a\xcb\xf0\x87\xa8\xb3a\xcfgI\x98\xccE\xcf\x1a\x11y\x06\xcb\xc9\xe34\bs\xdaw\x05J$(\x1b\xe0\xe6\xabNč1\xa4XB\x13\xc1\x13\xd76\x85\xf8O\xad\x96\x03\xe7R<ɽ\x8d\x8eٓ\x91&\x81\xb1-\xf9\x1by6ʵ\xff\x17\xa6\xb2w\xb9\x01\x8d\x04`\xb6\b\xe6\x01\f\x00ݿ\xd8;z\xf9\xe2d\xfe\xfb\xc7\x16=}D\xbcz\x9c< U|\xc7\xc96\x12?G\x83\xa8\x04\\\xc2n5\xb7p9e\xa6\xb9TIQ\x8f\xf1WJԻ>\xcaV(\x92\x98\xe29\xf9r\xd9U9fG\x92\x93\xfb\xe6t[\xb7k\xf1s:\xf2#\x91(\\0\xad\x1a\x03~-\xc5U\x95\x13\x9e\xe2p\a;\xb1\x1a\x90\xec\xc5|Ob\xfa\\Q\x15\xd44\x12ɛq1\x96Ɵ\xfb\x86S\xb9\x8b\x9f\x8b\xb0; 6`\u007f\xf5\x01\xaf\\ݖ\x0e4W\xd5\xddi@2\rf+\xe0\xf4\xe78\xdfR\x15\xaemt\x85\xfb\xe8\xd9Q>\x92\xfc\xd9\xf0C\x9f\xc6-&\x0f\x8el(\v\xa5\xb4pNE\xb3\x97Ku\x1d\x99^\xa2\v4\xf9\xe9B\xb9\xec$\xa0\xd5;f\xb8x\x97x43瀨Qiz\x04\x94S{\x137<.\xbe\x03\xddu\xdc \xe1\xd5\x12\x8aJ\x88:\xc2\xca\f:\x1c\x94\xd3$\xac\xd0hr\xea\x1c\xfc\xb0\xfc\xd2\xd2\xce_\xe5\xd2\xec\x19k\xdbG\x12GG\x82qbS\xda5F\xf6c\xd1fG~zd\x85s\x95\xc1wƢ_f7\xb9#T\xca'\x8c\xa2\x99\xcc\xf5\xc0\xc3\a~\xe60\xa3]\r\x125\x93\x11G\xd7{f\x9f=GYh\a\xf8K\xe2\xc8G\xba9\xf7\xe9V\x83U3ŝD\x87\xba:\u007fj\xec\x1dM估{\xc9\x11lۯ\x14\x1c\xb35\t\xf2|\x02\x05\xfcD]\x02\x98\x15\v\x12G\xc0\xa0\xc5\xe1\xd87\x14\xa1\x00\x11\x01\x00\x01\x89\x01\xb6\x04\x18\x01\n\x00 \x16!\x04\xc7$\xf3\x1a\u007f\xdf\xfc|\x90#\xb65\x82\xf2\xd7\xc7Ţ*s\x05\x02`\xb6\b\xe6\x02\x1b\f\x00\n\t\x10\x82\xf2\xd7\xc7Ţ*sO\x95\f\x00\xc9\xc4T\xeb\xc2\x1e&\xa6\x1c\x1f\xfd\x87g\bB-\x99\x93\xa7;d\rl\xdc!'ó\xe9=\x96S\xf7\x8e)GH\a\xcc79\x00\xf5\xdc])\xb0L\xddߋ\xd3\xdc\t\x81\xc0\xa8\x98\xe0JiF\xa8E\xect_\xfc^\xcd\xccH\xf5ڥ+\f\x90\xec۞r\xe7\x98[\x1f\xde\x0e\xdeo\bt\xe1厑U\xe3\xc1F\xc10i3\xf7CHx\x185\xd4R\xe1\xae\x12\x90\xed\xad\x8d\x01s\xa5I5FQ4\xce\xdbh\x02\a\xbb'\xe5\x1e1\x9aϗ\x97\x05\x82\x1b.*\xfb+\xb0\x9e\xb2a\x84\xbay\x8f\xe4\t\xb2`\xdf\x01\x8fI\xe3dV\xd18\xa2\x9c@\x99 \xb8\x92\xff\xd6M(ŨV\xe5\xbe\xf1\x96~\n\xe5\xbf^\x9f_\xf9\xa8\xb0\x12\xa66J\xbcd\xba\xa4Vo\xbenO\xe0,\x81\xeb\u007f!\x81\x8a6\x1c}9\x16B\x06y\xba\x89\xbb\xbc\xbe\x9aEVDNa\xb3\x83\xf6\x86\t\xeda\x9c!\x96\xe6\xe1`\xad>Y\x93L~\xed\xfb\x9d\x82.&\xd1g\x863\x1ef\x8e_m4\xa3Ť\\%\xd7@\xfb\xec\x92\xda'g\x88/\xe5\xe0\x18\xa3\xb9ַy\x8a\xd1b\x1c\xcc\xd7bR2~\f`B\x8d\xf2\x9e\xc3>\xc1\xe4\x12\\\x8cn:j\x8a\xfe\x1c\xf1\b%\xd4\x06\x1a\xccŎ\u007f\x95\xcc\xdc\x1b\x94\x06\xa7\x18\xbf\x88\v\xe2\x85Z\x9f\x9b\xe9.\xc0\x13\xb4`H\xbc\x12 \x96z\x15\x84n\xa6\xb4 {@\xf7*\xc1\xa6:\x85*\xd6Mx\xcf\x1et\xa8"), - } // define dirs dir1 := &embedded.EmbeddedDir{ Filename: "", - DirModTime: time.Unix(1622554116, 0), + DirModTime: time.Unix(1594040685, 0), ChildFiles: []*embedded.EmbeddedFile{ file2, // "arduino_public.gpg.key" - file3, // "board_index_public.gpg.key" }, } @@ -40,13 +33,12 @@ func init() { // register embeddedBox embedded.RegisterEmbeddedBox(`keys`, &embedded.EmbeddedBox{ Name: `keys`, - Time: time.Unix(1622554116, 0), + Time: time.Unix(1594040685, 0), Dirs: map[string]*embedded.EmbeddedDir{ "": dir1, }, Files: map[string]*embedded.EmbeddedFile{ - "arduino_public.gpg.key": file2, - "board_index_public.gpg.key": file3, + "arduino_public.gpg.key": file2, }, }) } diff --git a/arduino/security/signature_test.go b/arduino/security/signature_test.go index 44349b52b72..ffc1ba0ff46 100644 --- a/arduino/security/signature_test.go +++ b/arduino/security/signature_test.go @@ -25,9 +25,9 @@ import ( var ( PackageIndexPath = paths.New("testdata/package_index.json") PackageSignaturePath = paths.New("testdata/package_index.json.sig") - BoardIndexPath = paths.New("testdata/board_index.json") - BoardSignaturePath = paths.New("testdata/board_index.json.sig") - BoardKey = paths.New("board_index_public.gpg.key") + BoardIndexPath = paths.New("testdata/module_firmware_index.json") + BoardSignaturePath = paths.New("testdata/module_firmware_index.json.sig") + BoardKey = paths.New("keys/module_firmware_index_public.gpg.key") InvalidIndexPath = paths.New("testdata/invalid_file.json") ) diff --git a/arduino/security/signatures.go b/arduino/security/signatures.go index 49b75be4822..2bc7a9fec88 100644 --- a/arduino/security/signatures.go +++ b/arduino/security/signatures.go @@ -17,6 +17,8 @@ package security import ( "fmt" + "io" + "os" "github.com/arduino/go-paths-helper" rice "github.com/cmaglie/go.rice" @@ -29,28 +31,41 @@ import ( // fails this function returns false. The PGP entity in the trusted keychain that // produced the signature is returned too. func VerifyArduinoDetachedSignature(targetPath *paths.Path, signaturePath *paths.Path) (bool, *openpgp.Entity, error) { - return VerifyDetachedSignature(targetPath, signaturePath, paths.New("arduino_public.gpg.key")) + keysBox, err := rice.FindBox("keys") + if err != nil { + panic("could not find bundled signature keys") + } + arduinoKeyringFile, err := keysBox.Open("arduino_public.gpg.key") + if err != nil { + panic("could not find bundled signature keys") + } + return verifySignature(targetPath, signaturePath, arduinoKeyringFile) } // VerifyDetachedSignature checks that the detached GPG signature (in the // signaturePath file) matches the given targetPath file and is an authentic -// signature from the bundled trusted keychain. the keyPath is the path of the public key used. +// signature from the bundled trusted keychain. The keyPath is the path of the public key used. +// This function allows to specify the path of the key to use. // If any of the above conditions fails this function returns false. // The PGP entity in the trusted keychain that produced the signature is returned too. func VerifyDetachedSignature(targetPath *paths.Path, signaturePath *paths.Path, keyPath *paths.Path) (bool, *openpgp.Entity, error) { - keysBox, err := rice.FindBox("keys") + arduinoKeyringFile, err := os.Open(keyPath.String()) if err != nil { - panic("could not find bundled signature keys") - } - arduinoKeyringFile, err := keysBox.Open(keyPath.String()) - if err != nil { - panic("could not find bundled signature keys") + panic("could not open signature keys") } + defer arduinoKeyringFile.Close() + return verifySignature(targetPath, signaturePath, arduinoKeyringFile) +} + +//verifySignature is an helper function that checks that the detached GPG signature (in the +// signaturePath file) matches the given targetPath file and is an authentic +// signature. If any of the above conditions fails this function returns false. +// The PGP entity in the trusted keychain that produced the signature is returned too. +func verifySignature(targetPath *paths.Path, signaturePath *paths.Path, arduinoKeyringFile io.Reader) (bool, *openpgp.Entity, error) { keyRing, err := openpgp.ReadKeyRing(arduinoKeyringFile) if err != nil { return false, nil, fmt.Errorf("retrieving Arduino public keys: %s", err) } - target, err := targetPath.Open() if err != nil { return false, nil, fmt.Errorf("opening target file: %s", err) diff --git a/arduino/security/testdata/board_index.json b/arduino/security/testdata/module_firmware_index.json similarity index 100% rename from arduino/security/testdata/board_index.json rename to arduino/security/testdata/module_firmware_index.json diff --git a/arduino/security/testdata/board_index.json.sig b/arduino/security/testdata/module_firmware_index.json.sig similarity index 100% rename from arduino/security/testdata/board_index.json.sig rename to arduino/security/testdata/module_firmware_index.json.sig From 7acbe68d194d8dbd82e9984afe5c92d5bac73d96 Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Tue, 1 Jun 2021 18:39:37 +0200 Subject: [PATCH 5/5] move `module_firmware_index.gpg.key` under `testdata/` --- arduino/security/signature_test.go | 2 +- .../module_firmware_index_public.gpg.key | Bin 2 files changed, 1 insertion(+), 1 deletion(-) rename arduino/security/{keys => testdata}/module_firmware_index_public.gpg.key (100%) diff --git a/arduino/security/signature_test.go b/arduino/security/signature_test.go index ffc1ba0ff46..82d5572f219 100644 --- a/arduino/security/signature_test.go +++ b/arduino/security/signature_test.go @@ -27,7 +27,7 @@ var ( PackageSignaturePath = paths.New("testdata/package_index.json.sig") BoardIndexPath = paths.New("testdata/module_firmware_index.json") BoardSignaturePath = paths.New("testdata/module_firmware_index.json.sig") - BoardKey = paths.New("keys/module_firmware_index_public.gpg.key") + BoardKey = paths.New("testdata/module_firmware_index_public.gpg.key") InvalidIndexPath = paths.New("testdata/invalid_file.json") ) diff --git a/arduino/security/keys/module_firmware_index_public.gpg.key b/arduino/security/testdata/module_firmware_index_public.gpg.key similarity index 100% rename from arduino/security/keys/module_firmware_index_public.gpg.key rename to arduino/security/testdata/module_firmware_index_public.gpg.key