docs: add author and project background #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| host-and-firmware: | |
| runs-on: ubuntu-24.04 | |
| env: | |
| PYTHON_VERSION: "3.12" | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Install ARM GCC | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| gcc-arm-none-eabi \ | |
| binutils-arm-none-eabi \ | |
| make | |
| arm-none-eabi-gcc --version | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -r requirements.txt | |
| python -m pip install -e tools/secure_boot_hil[dev] | |
| - name: Run Ruff | |
| run: ruff check . | |
| - name: Check generated memory layout | |
| run: python tools/emit_memory_layout.py --check | |
| - name: Run Python and host tests | |
| run: PYTHONDONTWRITEBYTECODE=1 python -m pytest -q -p no:cacheprovider tests | |
| - name: Run secure-boot HIL host checks | |
| run: tools/secure_boot_hil/scripts/run_host_checks.sh | |
| - name: Build factory metadata provisioning tool | |
| run: | | |
| make -C tools clean test | |
| make -C tools clean test SANITIZE=1 | |
| - name: Build firmware projects | |
| run: | | |
| make -C firmware/exp045_bootloader_v2 clean all report LAYOUT_PROFILE=stm32f429_1m | |
| make -C firmware/exp065_signed_app clean all LAYOUT_PROFILE=stm32f429_1m | |
| make -C firmware/exp066_research_platform_core clean all LAYOUT_PROFILE=stm32f429_1m | |
| - name: Verify signed release artifacts | |
| run: | | |
| python - <<'PY' | |
| from pathlib import Path | |
| from nacl.signing import SigningKey | |
| seed = bytes(range(32)) | |
| Path("/tmp/ci_signing_seed.bin").write_bytes(seed) | |
| Path("/tmp/ci_public_key_hex.txt").write_text( | |
| bytes(SigningKey(seed).verify_key).hex(), | |
| encoding="ascii", | |
| ) | |
| PY | |
| PUBLIC_KEY_HEX="$(cat /tmp/ci_public_key_hex.txt)" | |
| make -C firmware/exp065_signed_app verify-signed \ | |
| LAYOUT_PROFILE=stm32f429_1m \ | |
| SIGNING_SEED=/tmp/ci_signing_seed.bin \ | |
| PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}" | |
| make -C firmware/exp066_research_platform_core verify-signed \ | |
| LAYOUT_PROFILE=stm32f429_1m \ | |
| SIGNING_SEED=/tmp/ci_signing_seed.bin \ | |
| PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}" | |
| make -C firmware/exp066_research_platform_core slot-releases \ | |
| LAYOUT_PROFILE=stm32f429_1m \ | |
| SIGNING_SEED=/tmp/ci_signing_seed.bin \ | |
| PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}" | |
| python tools/release_artifacts.py verify-release \ | |
| --bootloader-elf firmware/exp045_bootloader_v2/build/exp045_bootloader_v2.elf \ | |
| --bootloader-bin firmware/exp045_bootloader_v2/build/exp045_bootloader_v2.bin \ | |
| --bootloader-hex firmware/exp045_bootloader_v2/build/exp045_bootloader_v2.hex \ | |
| --application-elf firmware/exp066_research_platform_core/build/exp066_research_platform_core.elf \ | |
| --application-bin firmware/exp066_research_platform_core/build/exp066_research_platform_core.bin \ | |
| --application-hex firmware/exp066_research_platform_core/build/exp066_research_platform_core.hex \ | |
| --signed-image firmware/exp066_research_platform_core/build/exp066_research_platform_core_signed.bin \ | |
| --public-key-hex "${PUBLIC_KEY_HEX}" \ | |
| --manifest-output firmware/exp066_research_platform_core/build/ci_release_manifest.json \ | |
| --report-output firmware/exp066_research_platform_core/build/ci_release_verification.json \ | |
| --application-name exp066_research_platform_core \ | |
| --bootloader-version exp045 \ | |
| --release-version ci \ | |
| --git-commit "${GITHUB_SHA}" | |
| - name: Run host C verifier tests | |
| run: | | |
| make -C tests/host_verifier clean test | |
| make -C tests/host_verifier clean test SANITIZE=1 | |
| - name: Run update-storage foundation tests | |
| run: | | |
| make -C tests/update_storage clean test | |
| make -C tests/update_storage clean test SANITIZE=1 | |
| - name: Check deterministic builds and binary comparison | |
| run: python tools/check_deterministic_build.py | |
| - name: Scan tracked files for private key material | |
| run: python tools/check_no_private_keys.py | |
| - name: Check whitespace | |
| run: git diff --check |