Hands-On: OTA Update Pipeline

#!/bin/bash
# Build and sign OTA firmware package
set -e

FIRMWARE_VERSION="2.4.1"
TARGET_ECU="zone_ecu_front"
SIGNING_KEY="keys/ota_signing_key.pem"
FIRMWARE_BIN="build/firmware_v${FIRMWARE_VERSION}.bin"

# Step 1: Cross-compile firmware
echo "[1/4] Building firmware v${FIRMWARE_VERSION}..."
cmake --preset release -DFIRMWARE_VERSION="${FIRMWARE_VERSION}"
cmake --build build/ --target zone_ecu_firmware

# Step 2: Compute SHA-256 hash
echo "[2/4] Computing image hash..."
HASH=$(sha256sum "${FIRMWARE_BIN}" | cut -d" " -f1)
echo "SHA-256: ${HASH}"

# Step 3: Create UPTANE targets.json
echo "[3/4] Creating UPTANE metadata..."
python3 - <<EOF
import json, time
targets = {
    "_type": "Targets",
    "version": 2,
    "expires": "2026-12-31T00:00:00Z",
    "targets": {
        f"${TARGET_ECU}/firmware.bin": {
            "hashes": {"sha256": "${HASH}"},
            "length": $(wc -c < "${FIRMWARE_BIN}"),
            "custom": {
                "version": "${FIRMWARE_VERSION}",
                "ecu_identifier": "${TARGET_ECU}"
            }
        }
    }
}
with open("targets.json", "w") as f:
    json.dump(targets, f, indent=2)
print("targets.json created")
EOF

# Step 4: Sign with ECDSA P-256
echo "[4/4] Signing with OEM key..."
openssl dgst -sha256 -sign "${SIGNING_KEY}" \
    -out targets.json.sig targets.json
echo "OTA package ready: ${FIRMWARE_BIN} + targets.json + targets.json.sig"