Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(cmakev2/build): add idf_check_binary_signed function

Browse Source 
Given the binary target generated by the idf_build_binary or
idf_sign_binary function, add a new POST_BUILD dependency that displays
a message indicating the binary image must be manually signed before
flashing. This situation arises when CONFIG_SECURE_SIGNED_APPS is
enabled, but CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES is not set.  As a
result, the binary image is not signed during the build process and
requires manual signing.

Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
This commit is contained in:
Frantisek Hrbata
2025-09-09 08:44:56 +02:00
parent 8b65c7dce2
commit d41da7dd4f
1 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
tools/cmakev2/build.cmake
View File

@@ -904,3 +904,54 @@ function(idf_check_binary_size binary)
PARTITION_TYPE app)
add_dependencies("${binary}" "${binary}_check_size")
endfunction()
#[[api
.. cmakev2:function:: idf_check_binary_signed
.. code-block:: cmake
idf_check_binary_signed(<binary>)
:binary[in]: Binary image target to which to add a partition size check.
The ``binary`` target is created by the ``idf_build_binary``.
If the binary is not signed and signed applications are required with
CONFIG_SECURE_SIGNED_APPS, print a note indicating that the binary needs to
be signed manually. This situation can occur if the binary images are not
signed during the build because CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES is
not set.
#]]
function(idf_check_binary_signed binary)
if(NOT CONFIG_SECURE_SIGNED_APPS)
# Signed binaries are not required.
return()
endif()
if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
# Binary should be already signed with idf_sign_binary.
return()
endif()
get_target_property(binary_path ${binary} BINARY_PATH)
if(NOT binary_path)
idf_die("Binary target '${binary}' is missing 'BINARY_PATH' property.")
endif()
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
set(secure_boot_version "1")
elseif(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
set(secure_boot_version "2")
endif()
idf_component_get_property(espsecure_py_cmd esptool_py ESPSECUREPY_CMD)
string(REPLACE ";" " " espsecure_py_cmd "${espsecure_py_cmd}")
get_filename_component(binary_name "${binary_path}" NAME)
add_custom_command(TARGET "${binary}" POST_BUILD
COMMAND ${CMAKE_COMMAND} -E echo
"Binary '${binary_name}' not signed. Sign it before flashing with:"
COMMAND ${CMAKE_COMMAND} -E echo
"${espsecure_py_cmd} sign_data --keyfile KEYFILE --version ${secure_boot_version}"
"${binary_path}"
VERBATIM)
endfunction()