From d1bbecb9ee0f43d3b0a92adc4396807addfd5b0a Mon Sep 17 00:00:00 2001
From: ScottW514 <s.e.wiederhold@gmail.com>
Date: Sat, 8 Aug 2026 14:02:15 -0400
Subject: [PATCH] forgefirm-keys: verification trust anchors; forgectrl update
 manager

/etc/forgefirm/keys ships the ForgeFIRM release-signing public key
and the Glowforge factory keyring (public keys only) - the update
manager verifies release downloads/uploads against the former and
factory archives against the latter. forgectrl SRCREV bumped to the
update-manager commit; runtime deps on ffboot, fwup, the keyring, and
curl made explicit.
---
 .../recipes-forgefirm/forgectrl/forgectrl.bb  |   8 +++---
 .../files/forgefirm-release.pub               |   1 +
 .../forgefirm-keys/files/gf/2017-04-000.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-001.pub   | Bin 0 -> 32 bytes
 .../forgefirm-keys/files/gf/2017-04-002.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-003.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-004.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-005.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-006.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-007.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-008.pub   |   1 +
 .../forgefirm-keys/files/gf/2017-04-009.pub   | Bin 0 -> 32 bytes
 .../forgefirm-keys/files/gf/2017-05-001.pub   |   1 +
 .../forgefirm-keys/forgefirm-keys.bb          |  23 ++++++++++++++++++
 14 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub
 create mode 100644 meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb

diff --git a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
index 70342df..1935c67 100644
--- a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
+++ b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
@@ -9,15 +9,17 @@ PV = "0.1.0"
 
 SRC_URI = "git://github.com/ScottW514/forgectrl.git;protocol=https;branch=main"
 # Pinned; bump deliberately after pushing forgectrl changes.
-SRCREV = "945d85e37bbb4888b1cb12a837b25e6483f1a95d"
+SRCREV = "64bec0edc7e98c0d071ad594c322babe54341d3c"
 
 S = "${WORKDIR}/git"
 
 inherit cmake update-rc.d
 
 DEPENDS += "ulfius jpeg"
-# media-ctl / v4l2-ctl configure the imx-media pipeline at runtime
-RDEPENDS:${PN} = "v4l-utils"
+# media-ctl / v4l2-ctl configure the imx-media pipeline at runtime;
+# the update manager drives ffboot + fwup and verifies against the
+# shipped keyring; release checks and downloads use curl.
+RDEPENDS:${PN} = "v4l-utils ffboot fwup forgefirm-keys curl"
 
 INITSCRIPT_NAME = "forgectrl"
 INITSCRIPT_PARAMS = "defaults 90"
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub
new file mode 100644
index 0000000..c15409f
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub
@@ -0,0 +1 @@
+fHw/N5H/5tuBxjRBS2+r7RRl+ykltrFjsh04y/uFkXU=
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub
new file mode 100644
index 0000000..ac9a670
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub
@@ -0,0 +1 @@
+,md2#U…”‡>0HeáÓ!ÌqW«3éÁƒfàø¨
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub
new file mode 100644
index 0000000000000000000000000000000000000000..6a3a9e0027e7be2fae9c332306372611d646c273
GIT binary patch
literal 32
qcmV+*0N?*?h`!3aB230Y@SuS;cs{Vy#P|jo-<XnX;MA%r0ECJl7ZDTy

literal 0
HcmV?d00001

diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub
new file mode 100644
index 0000000..82c0277
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub
@@ -0,0 +1 @@
+‚ùë™1)«Åˇ“qÏÿqI“,kñnB
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub
new file mode 100644
index 0000000..e8ada97
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub
@@ -0,0 +1 @@
+5x« msç�úsÍá|‚¸ßal¾íˆPð‹«éûu¾ÝÞ
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub
new file mode 100644
index 0000000..0fc1a2f
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub
@@ -0,0 +1 @@
+¡«ä�®-碥]QGƒáÿÉÈ5©Ì_ÊìÓÙË(
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub
new file mode 100644
index 0000000..f7ecb26
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub
@@ -0,0 +1 @@
+XÊXgýä-£°ªxPª87½ïíf|†z9múc±1
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub
new file mode 100644
index 0000000..1553cf4
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub
@@ -0,0 +1 @@
+׆ËgÕ¤
Øp“Z‰öåEâZ€D$‚ç"³ïc5«›
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub
new file mode 100644
index 0000000..26f1f55
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub
@@ -0,0 +1 @@
+¬�©0¹³íôs·GƒôCukH€�»¸Î Å1OîZÃãŸ
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub
new file mode 100644
index 0000000..802a7e3
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub
@@ -0,0 +1 @@
+�qY\(!êò÷ƒï7ï1/?7}2ËŸ8ò9Ú#úý@§ÿ
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub
new file mode 100644
index 0000000000000000000000000000000000000000..9556b609d49ffb9e37aa51b3e9b20e8ddef0f3c2
GIT binary patch
literal 32
ocmdO$q>vYOmEp^eh}b`qoCBXM>r=aL*8kZ~RKcNg{_T&C0Rk8hivR!s

literal 0
HcmV?d00001

diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub
new file mode 100644
index 0000000..f7a1724
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub
@@ -0,0 +1 @@
+Øçtjò1°qº†Såù1x]f+ÿBcø¯—b7U
fî
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb
new file mode 100644
index 0000000..1f59350
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb
@@ -0,0 +1,23 @@
+SUMMARY = "Firmware verification public keys"
+DESCRIPTION = "Trust anchors for firmware archive verification: the \
+ForgeFIRM release-signing public key (verifies release downloads and \
+uploads) and the Glowforge factory keyring (verifies factory .fw \
+archives for cloud restore). Public keys only."
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+SRC_URI = " \
+    file://forgefirm-release.pub \
+    file://gf \
+"
+
+S = "${WORKDIR}"
+
+do_install() {
+    install -d ${D}${sysconfdir}/forgefirm/keys/gf
+    install -m 0644 ${WORKDIR}/forgefirm-release.pub \
+        ${D}${sysconfdir}/forgefirm/keys/forgefirm-release.pub
+    install -m 0644 ${WORKDIR}/gf/*.pub ${D}${sysconfdir}/forgefirm/keys/gf/
+}
+
+FILES:${PN} = "${sysconfdir}/forgefirm/keys"