stm32-security-lab/.github/workflows/ci.yml at 46c8ffb28ef024e5357210f73cee3c1136670579 · Zimbo88/stm32-security-lab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  host-and-firmware:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      PYTHON_VERSION: "3.12"
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install ARM GCC
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gcc-arm-none-eabi \
            binutils-arm-none-eabi \
            libnewlib-arm-none-eabi \
            make
          arm-none-eabi-gcc --version

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          python -m pip install -e tools/secure_boot_hil[dev]

      - name: Run Ruff
        run: ruff check .

      - name: Check generated memory layout
        run: python tools/emit_memory_layout.py --check

      - name: Run Python and host tests
        run: PYTHONDONTWRITEBYTECODE=1 python -m pytest -q -p no:cacheprovider tests

      - name: Run secure-boot HIL host checks
        run: tools/secure_boot_hil/scripts/run_host_checks.sh

      - name: Build factory metadata provisioning tool
        run: |
          make -C tools clean test
          make -C tools clean test SANITIZE=1

      - name: Build firmware projects
        run: |
          make -C firmware/exp045_bootloader_v2 clean all report LAYOUT_PROFILE=stm32f429_1m
          make -C firmware/exp065_signed_app clean all LAYOUT_PROFILE=stm32f429_1m
          make -C firmware/exp066_research_platform_core clean all LAYOUT_PROFILE=stm32f429_1m

      - name: Verify signed release artifacts
        run: |
          python - <<'PY'
          from pathlib import Path
          from nacl.signing import SigningKey

          seed = bytes(range(32))
          Path("/tmp/ci_signing_seed.bin").write_bytes(seed)
          Path("/tmp/ci_public_key_hex.txt").write_text(
              bytes(SigningKey(seed).verify_key).hex(),
              encoding="ascii",
          )
          PY
          PUBLIC_KEY_HEX="$(cat /tmp/ci_public_key_hex.txt)"
          make -C firmware/exp065_signed_app verify-signed \
            LAYOUT_PROFILE=stm32f429_1m \
            SIGNING_SEED=/tmp/ci_signing_seed.bin \
            PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}"
          make -C firmware/exp066_research_platform_core verify-signed \
            LAYOUT_PROFILE=stm32f429_1m \
            SIGNING_SEED=/tmp/ci_signing_seed.bin \
            PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}"
          make -C firmware/exp066_research_platform_core slot-releases \
            LAYOUT_PROFILE=stm32f429_1m \
            SIGNING_SEED=/tmp/ci_signing_seed.bin \
            PUBLIC_KEY_HEX="${PUBLIC_KEY_HEX}"
          python tools/update_package.py verify \
            --package firmware/exp066_research_platform_core/build/exp066_research_platform_core_slot_a_update_v2.bin \
            --slot a \
            --application firmware/exp066_research_platform_core/build/exp066_research_platform_core.bin \
            --public-key-hex "${PUBLIC_KEY_HEX}" \
            --json-output firmware/exp066_research_platform_core/build/ci_slot_a_update_verify.json
          python tools/update_package.py verify \
            --package firmware/exp066_research_platform_core/build/slot_a/exp066_research_platform_core_slot_a_slot_a_update_v2.bin \
            --slot a \
            --application firmware/exp066_research_platform_core/build/slot_a/exp066_research_platform_core_slot_a.bin \
            --public-key-hex "${PUBLIC_KEY_HEX}" \
            --json-output firmware/exp066_research_platform_core/build/slot_a/ci_slot_a_release_verify.json
          python tools/update_package.py verify \
            --package firmware/exp066_research_platform_core/build/slot_b/exp066_research_platform_core_slot_b_slot_b_update_v2.bin \
            --slot b \
            --application firmware/exp066_research_platform_core/build/slot_b/exp066_research_platform_core_slot_b.bin \
            --public-key-hex "${PUBLIC_KEY_HEX}" \
            --json-output firmware/exp066_research_platform_core/build/slot_b/ci_slot_b_release_verify.json

      - name: Run host C verifier tests
        run: |
          make -C tests/host_verifier clean test
          make -C tests/host_verifier clean test SANITIZE=1

      - name: Run update-storage foundation tests
        run: |
          make -C tests/update_storage clean test
          make -C tests/update_storage clean test SANITIZE=1

      - name: Check deterministic builds and binary comparison
        run: python tools/check_deterministic_build.py

      - name: Scan tracked files for private key material
        run: python tools/check_no_private_keys.py

      - name: Check whitespace
        run: git diff --check