Sign a packbeam archive so a device configured with firmware_keys will
install it.
mix nerves_hub.sign --key ~/keys/fwup-key.privPackbeam has no signature format of its own, so this appends an entry named
nerves_hub/signature after everything it signs. The entry is a data file,
the class AtomVM skips when looking for code, so a signed archive still boots
on a stock VM.
The key is the organization's existing fwup private key. An fwup private key
is a 32 byte Ed25519 seed followed by its public key, and that trailing half
is byte for byte the .pub NervesHub already stores, so signing packbeams
adds no key management.
Signing every build
Chain it onto the packbeam alias, and signing stops being a step anyone can forget:
aliases: [
"atomvm.packbeam": ["atomvm.application_bin", "atomvm.packbeam", "nerves_hub.sign"]
]A build then needs the key present, so a contributor without it cannot build at all and CI has to be given one before anything works. That is the trade, and it is the reason this is not wired up for you.
Options
--key- path to the private key. Defaults to$NERVES_HUB_FW_PRIVATE_KEY--in- archive to sign. Defaults to<app>.avmin the project root--out- where to write it. Defaults to signing in place--check- verify and report, changing nothing
A path, never the key itself. mix.exs is committed, and a key in an
environment variable is readable in process listings and tends to end up in
CI logs.