vh/forgefirm
1
0
Fork 0
mirror of https://github.com/openglow-org/forgefirm.git synced 2026-09-27 08:41:13 -07:00
Code Issues Packages Projects Releases Wiki Activity

Update key prov

Browse Source
This commit is contained in:
ScottW514
2026-09-18 11:21:44 -04:00
parent 091702c26f
commit 07158e5d7f
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/README
+27
View File
@@ -0,0 +1,27 @@
Glowforge factory keyring
=========================
Eleven Ed25519 *public* keys, 32 raw bytes each, recovered from Glowforge
factory firmware. They are the factory trust anchors: ForgeFIRM ships them so
the machine can verify the signature on a factory `.fw` archive during a
factory restore. They verify archives and nothing else.
Public key material only. No private or secret key belongs in this directory,
and nothing here can be used to sign anything. ForgeFIRM's own release-signing
public key is `../forgefirm-release.pub`; its private half is held offline by
the operator and is not in this repository, in CI, or in any cloud-synced
store.
Provenance and rights
---------------------
These keys are Glowforge, Inc.'s. They are bare cryptographic public keys --
algorithm output, carrying no authorship -- so no copyright subsists in them
and none is claimed. 514 LLC d/b/a OpenGlow asserts no rights over them and
grants none; the recipe's `LICENSE = "MIT"` covers the recipe, not this key
material. Glowforge has not published these keys itself, so there is no
upstream license to point to and none is implied.
For how the trust anchors are used, see "The update manager" and "Decisions"
on the documentation site:
https://docs.forgefirm.org/technical/forgefirm/install-and-update/
meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb
+4
View File
@@ -3,6 +3,10 @@ DESCRIPTION = "Trust anchors for firmware archive verification: the \
ForgeFIRM release-signing public key (verifies release downloads and \
uploads) and the Glowforge factory keyring (verifies factory .fw \
archives for cloud restore). Public keys only."
# LICENSE covers this recipe, not the key material. The Glowforge factory
# keyring in files/gf/ is Glowforge, Inc.'s: bare Ed25519 public keys, in which
# no copyright subsists and over which OpenGlow claims nothing and grants
# nothing. files/gf/README records that and the public-key-only boundary.
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"