Code Signing & Signature Verification

#!/usr/bin/env python3
# pip install cryptography
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
from cryptography.hazmat.backends import default_backend
import struct, hashlib, os

def sign_firmware(binary: bytes, privkey_pem: str, sw_version: int, out_path: str):
    with open(privkey_pem, "rb") as f:
        key = serialization.load_pem_private_key(f.read(), None, default_backend())

    der = key.sign(binary, ec.ECDSA(hashes.SHA256()))
    r, s = decode_dss_signature(der)
    sig  = r.to_bytes(32,"big") + s.to_bytes(32,"big")

    header = struct.pack(">4sII20s64s420s",
        b"ASBL", sw_version, len(binary), bytes(20), sig, bytes(420))
    with open(out_path, "wb") as f: f.write(header + binary)
    print(f"Signed: {out_path} ({len(header)+len(binary)} bytes, v0x{sw_version:08X})")

def gen_dev_keypair():
    k = ec.generate_private_key(ec.SECP256R1(), default_backend())
    open("dev_priv.pem","wb").write(k.private_bytes(
        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
        serialization.NoEncryption()))
    open("dev_pub.pem","wb").write(k.public_key().public_bytes(
        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo))
    print("Dev keypair generated (NEVER use private key in production)")