feat(ota): Add support for signed binaries #11968
Conversation
lucasssvaz
added
Area: Libraries
👋 Hello lucasssvaz, we appreciate your contribution to this project! 📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more. 🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project. Click to see more instructions ...
Review and merge process you can expect ...
|
lucasssvaz
force-pushed
the
feat/ota_sign
branch
from
800dacd to
e8563d5
Compare
lucasssvaz
force-pushed
the
feat/ota_sign
branch
2 times, most recently
from
5517c9b to
59e4a95
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Test Results 76 files 76 suites 14m 53s ⏱️ Results for commit 31f717f. ♻️ This comment has been updated with latest results. |
lucasssvaz
force-pushed
the
feat/ota_sign
branch
from
59e4a95 to
66a7b7f
Compare
lucasssvaz
force-pushed
the
feat/ota_sign
branch
from
66a7b7f to
31f717f
Compare
Memory usage test (comparing PR against master branch)The table below shows the summary of memory usage change (decrease - increase) in bytes and percentage for each target.
Click to expand the detailed deltas report [usage change in BYTES]
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Description of Change
This pull request introduces secure OTA (Over-The-Air) firmware update capabilities with cryptographic signature verification to the ArduinoOTA library and its examples. The main focus is on enabling devices to only accept firmware that has been signed with an authorized private key, significantly improving security against unauthorized or tampered updates. The changes include new example code, documentation, build workflow updates, and modifications to the ArduinoOTA core to support signature verification.
Key changes:
Secure OTA Signature Verification Support
ArduinoOTAlibrary, allowing users to specify a signature verifier (RSA or ECDSA) via the newsetSignature()method. This ensures only signed firmware is accepted during OTA updates. [1] [2] [3] [4] [5] [6]New Example: SignedOTA
SignedOTAexample, including:SignedOTA.ino: Demonstrates secure OTA with signature verification, configurable for different algorithms and optional password protection.public_key.h: Contains a test RSA public key for demonstration purposes; users are instructed to generate and use their own keys.README.md: Comprehensive instructions for setup, key generation, signing firmware, and troubleshooting.ci.yml: Ensures the example is only built when WiFi support is present.Build and Workflow Enhancements
build_py_tools.yml) to include the newtools/bin_signing.pytool, which is required for signing firmware images as part of the secure OTA process. [1] [2]These changes collectively add a robust security layer to OTA updates, protecting devices from unauthorized or malicious firmware installations.
Test Scenarios
Tested locally
Related links
Closes #8141