Skip to content

sign-tool: Add option to export binary pub key from Signify pub key - #40

Merged
mchack-work merged 3 commits into
mainfrom
export-binary-from-pub
Jul 3, 2026
Merged

sign-tool: Add option to export binary pub key from Signify pub key#40
mchack-work merged 3 commits into
mainfrom
export-binary-from-pub

Conversation

@mchack-work

@mchack-work mchack-work commented Jul 3, 2026

Copy link
Copy Markdown
Member

Description

In order to be able to sign a a vendor pubkey and install it with tkey-mgt -cmd install-pubkey we need to have the binary form of the new key.

If we're using a TKey for signing, we get the pubkey in Signify form from tkey-sign -G. Let's make it possible to convert to binary form with:

sign-tool -P newkey.bin -p newkey.pub

Type of change

Please tick any that are relevant to this PR and remove any that aren't.

  • Bugfix (non breaking change which resolve an issue)
  • Feature (non breaking change which adds functionality)
  • Breaking Change (a change which would cause existing functionality to not work as expected)
  • Documentation (a change to documentation)

Submission checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my changes
  • I have tested and verified my changes on target
  • My changes are well written and CI is passing
  • I have squashed my work to relevant commits and rebased on main for linear history
  • I have added a "Co-authored-by: x" if several people contributed, either pair programming or by squashing commits from different authors.
  • I have updated the documentation where relevant (readme, dev.tillitis.se etc.)
  • QEMU is updated to reflect changes

@mchack-work
mchack-work requested a review from agren July 3, 2026 10:35
@dehanj

dehanj commented Jul 3, 2026

Copy link
Copy Markdown
Member

The description of -p only reflect when writing to the the file it points two

	pubkeyPath := flag.String("p", "", "File to write pubkey to")

But now it has a usage as both and input and and output path.

mchack-work and others added 3 commits July 3, 2026 14:22
In order to be able to sign a a vendor pubkey and install it with
tkey-mgt -cmd install-pubkey we need to have the binary form of the
new key.

If we're using a TKey for signing, we get the pubkey in Signify form
from tkey-sign -G. Let's make it possible to convert to binary form
with:

sign-tool -P newkey.bin -p newkey.pub
@mchack-work
mchack-work force-pushed the export-binary-from-pub branch from 45f0d60 to ba88693 Compare July 3, 2026 12:22
@mchack-work

Copy link
Copy Markdown
Member Author

The description of -p ...
But now it has a usage as both and input and and output path.

Thanks. Fixed.

@mchack-work
mchack-work marked this pull request as ready for review July 3, 2026 12:23
@mchack-work
mchack-work merged commit ba88693 into main Jul 3, 2026
2 checks passed
@mchack-work
mchack-work deleted the export-binary-from-pub branch July 3, 2026 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants