Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nitrokey FIDO2 128kB update #186

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Nitrokey FIDO2 128kB update #186

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion pynitrokey/cli/update.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,8 +122,33 @@ def update(serial, yes, force):
ver = client.solo_version()
local_print(f"\tCurrent Firmware version: {ver[0]}.{ver[1]}.{ver[2]}")

# to find the variant (128kB vs 256kB), switch to the bootloader and get its public key
p = find(serial)
if not p.is_solo_bootloader():
local_print("Not in Bootloader Mode!")
return

# todo refactor and extract
from binascii import b2a_hex
from hashlib import sha256
bpub = p.boot_pubkey()
bpub = b2a_hex(bpub)
# local_print(f"Bootloader public key: \t\t{bpub}")
s = sha256()
s.update(bpub)
bpubh = b2a_hex(s.digest())
# local_print(f"Bootloader public key sha256: \t{bpubh}")

variants = {
"256": b'11d0b23f9f4f1aa319277aabab439447a6a8b89406a03f8ced2c39869c8a2724',
"128": b'TODO insert bootloader key hash here',
# todo: add 128kB variant
}
variant = variants[bpubh]
# todo go over the latest tag assets and check the currently connected variant version
#

# if the downloaded firmware version is the same as the current one, skip update unless force switch is provided
# if f'firmware-{ver[0]}.{ver[1]}.{ver[2]}' in gh_release_data['tag_name'] and not force:
if f"firmware-{ver[0]}.{ver[1]}.{ver[2]}" in download_url:
if not force:
local_critical(
Expand Down