Provide new command -F to get firmware digest

cmd/tkey-sign/main.go

@@ -27,6 +27,7 @@ type command int
 const (
 	cmdUnknown = iota
 	cmdGetKey
+	cmdGetFW
 	cmdSign
 	cmdVerify
 )
@@ -107,6 +108,18 @@ func signFile(signer tkeysign.Signer, pubkey []byte, fileName string) (*signatur
 	return &s, nil
 }
 
+// getFW asks signer to hash the length part of the firmware
+//
+// It returns the BLAKE2s digest on success or an error.
+func getFW(signer tkeysign.Signer, len int) ([]byte, error) {
+	digest, err := signer.GetFWDigest(len)
+	if err != nil {
+		return []byte{}, err
+	}
+
+	return digest, nil
+}
+
 // verifySignature verifies a Ed25519 signature stored in sigFile over
 // messageFile with public key in pubkeyFile
 func verifySignature(messageFile string, sigFile string, pubkeyFile string) error {
@@ -263,6 +276,7 @@ func main() {
 	var cmd command
 	var cmdArgs int
 	getKey := pflag.BoolP("getkey", "G", false, "Get public key.")
+	getFirmware := pflag.BoolP("getfw", "F", false, "Get firmware digest.")
 	sign := pflag.BoolP("sign", "S", false, "Sign the message.")
 	verify := pflag.BoolP("verify", "V", false, "Verify signature of the message.")
 	force := pflag.BoolP("force", "f", false, "Force writing of signature and pubkey files, overwriting any existing files.")
@@ -310,6 +324,11 @@ func main() {
 		cmdArgs++
 	}
 
+	if *getFirmware {
+		cmd = cmdGetFW
+		cmdArgs++
+	}
+
 	if *sign {
 		cmd = cmdSign
 		cmdArgs++
@@ -361,6 +380,18 @@ func main() {
 
 		signer.Close()
 
+	case cmdGetFW:
+		signer, _, err := loadSigner(*devPath, *speed, *ussFile, *enterUss)
+		if err != nil {
+			le.Printf("Couldn't load signer: %v", err)
+			os.Exit(1)
+		}
+
+		digest, err := getFW(*signer, 4711)
+		le.Printf("digest: %x\n", digest)
+
+		signer.Close()
+
 	case cmdSign:
 		if *messageFile == "" {
 			le.Printf("Provide message file with -m message")

go.mod

@@ -22,3 +22,5 @@ require (
 	golang.org/x/sys v0.14.0 // indirect
 	golang.org/x/term v0.14.0 // indirect
 )
+
+replace github.com/tillitis/tkeysign => ../tkeysign