Fun with firmware file formats and fingerprints

• data

  13 41 6.6 HTML

  :package: Data files for Trezor (by trezor)

  

Now, on to fingerprints. All the firmware update logic is driven by a file called releases.json (trezor-one version). This file was last updated in commit #d4aaa1b signed with GPG key 4AEE18F83AFDEB23 belonging to @vdovhanych. In this file is a 256bit checksum called fingerprint. Now through the git GPG signature we can verify the authenticity of this file, and through the fingerprint we can verify the authenticity of the firmware.

• trezor-firmware

  889 1,262 9.8 C

  :lock: Trezor Firmware Monorepo

  

Now with the help of curl, tail, dd, openssl and xxd we should be happy that nothing fishy is happening with the firmware verification. If we are less skeptical, obviously the trezorctl firmware verify command will do all this for us. And if you want even more verbosity the headertool.py script will do all of this, and then some. One really nice feature is the "critical bugfix" flag to know when updates are really manditory.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project