Hands-On: Full OTA Update Pipeline

#!/usr/bin/env python3
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
from cryptography.hazmat.backends import default_backend
import struct, hashlib

def build_signed_image(raw: bytes, key_pem: str, version: int, out: str):
    # CRC-32
    crc = 0xFFFFFFFF
    for b in raw:
        crc ^= b
        for _ in range(8): crc = (crc>>1)^0xEDB88320 if crc&1 else crc>>1
    crc ^= 0xFFFFFFFF

    # App header (256 bytes): magic + version + length + crc + padding
    ahdr = struct.pack(">IIII", 0xDEADC0DE, version, len(raw), crc) + bytes(256-16)
    payload = ahdr + raw   # what gets signed and flashed

    # ECDSA P-256 sign
    key  = serialization.load_pem_private_key(open(key_pem,"rb").read(), None, default_backend())
    der  = key.sign(payload, ec.ECDSA(hashes.SHA256()))
    r, s = decode_dss_signature(der)
    sig  = r.to_bytes(32,"big") + s.to_bytes(32,"big")

    # ASBL header (512 bytes)
    asbl = struct.pack(">4sII20s64s420s", b"ASBL", version, len(payload), bytes(20), sig, bytes(420))
    open(out,"wb").write(asbl + payload)
    print(f"Built {out}: {len(asbl+payload)} bytes  v0x{version:08X}  CRC 0x{crc:08X}")

import json, os
NVM="/tmp/boot_nvm.json"

def rd(): return json.load(open(NVM)) if os.path.exists(NVM) else {
    "active":"B","a_valid":True,"b_valid":True,"attempts":0}
def wr(d): json.dump(d,open(NVM,"w"))

def pbl():
    n=rd()
    if n["attempts"]>=3:
        fb="A" if n["active"]=="B" else "B"
        print(f"PBL: ROLLBACK to Bank {fb}")
        n["active"]=fb; n["attempts"]=0
    n["attempts"]+=1; wr(n)
    print(f"PBL: boot Bank {n['active']}  attempts={n['attempts']}")

def app_confirm():
    n=rd(); n["attempts"]=0; wr(n); print("App: confirmed (attempts=0)")

# Simulate 3 crashes then successful boot
wr({"active":"B","a_valid":True,"b_valid":True,"attempts":0})
for i in range(4):
    pbl()
    if i==3: app_confirm()