Reproducible builds #579
Comments
|
There are few errors in your process, I would suggest read our help center topic, or at least our CI task file, and get a basic understanding of which source to use, and how to verify it correctly. First of all, you seems using the wrong branch, for Second, firmware binary file contains a field for populating hash and signature, that's how firmware verification on device works. Our released firmware file have those field popluated by hashing and signing with our private key, which fill in those zero area you found different. In your script, you did not skip the header part, thus the hash will be different for sure, and this is wrong wget -O downloaded-firmware.bin "https://github.com/OneKeyHQ/firmware/releases/download/${TYPE}%2Fv${VERSION}/${TYPE}.${VERSION}-Stable-${SHORT_RELEASE_DATE}-${SHORT_HASH}.signed.bin"
# Calculate SHA-256 checksums
echo "Calculating checksums..."
sha256sum ./${TYPE}*Stable*.bin > built_firmware.sha256
sha256sum downloaded-firmware.bin > downloaded_firmware.sha256
# Display the results
echo -e "\e[96mRESULTS=========================================="
echo -e "Built firmware hash:"
cat built_firmware.sha256
echo -e "Downloaded firmware hash:"
cat downloaded_firmware.sha256
echo -e "=================================================\e[0m"
'The correct way of doing it is to skip the header tail -c +1024 /path/to/(file path) | shasum -a 256For firmware header, it's detailed in this file |
|
Thanks. Will read your new documentation, thanks for the heads up! I will try to verify manually first and then create a script afterwards.A few problems I encountered:
Possible solution: To build it myself. |
Some progress:The bash script: onekey.classic.sh The dockerfile: onekey.classic.dockerfile ===== Begin Results ===== 5db9faa8dbab83c0df4ab7c0295a5d5339f606f778d8bfd0c0131f7fc44c29b2 - built firmware hash (excluding header) a8d7051ea8b4a85038d032e4b86d5e8ee8f34870e3f861e59bf1a5578c36d176 - downloaded firmware hash (including header) (from: github releases) c1847cd787e33961e27e4f7dacd045fc495b5128e3aac98fb89a1a7393f9023d - downloaded firmware hash (excluding header) (from: github releases) a8d7051ea8b4a85038d032e4b86d5e8ee8f34870e3f861e59bf1a5578c36d176 - downloaded firmware hash (including header) (from: OneKey CDN) c1847cd787e33961e27e4f7dacd045fc495b5128e3aac98fb89a1a7393f9023d - downloaded firmware hash (excluding header) (from: OneKey CDN)
|
|
With the changes suggested:
Using tail
With the built firmware not stripped
|
Describe the bug
We successfully built version 3.9.0, using this bash script and this dockerfile.
Firmware version and revision
Desktop/smartphone setup (please complete the following information):
To Reproduce
Steps to reproduce the behavior:
One of the differences is the timestamp. The built firmware's value is 0917 - the date today. While the time stamp (or the short_release_date) on the downloaded firmware is 0805.
The second difference occurs between offsets
00000220to00000320. In the built firmware, we noticed that the values are comprised of zeroes. The corresponding offsets in the downloaded firmware is comprised of non-zeroes. This could indicate missing data in the built firmware.We do not have enough data to determine the reason for the diffs here:
The text was updated successfully, but these errors were encountered: