sphinx-key: ota binary checks in standalone module

sphinx-key/src/bitcoin_utils.rs

@@ -0,0 +1,41 @@
+use crate::bitcoin::{
+    hashes::{sha256, Hash},
+    secp256k1::Secp256k1,
+    util::misc::{signed_msg_hash, MessageSignature},
+    Address,
+};
+use anyhow::{anyhow, Result};
+use base64::{engine::general_purpose::STANDARD, Engine as _};
+use std::fs::File;
+use std::io::BufReader;
+
+const ADDRESS: &str = "1K51sSTyoVxHhKFtwWpzMZsoHvLshtw3Dp";
+
+pub(crate) fn check_signature(msg: &str, sig: &str) -> Result<()> {
+    let add = ADDRESS.parse::<Address>()?;
+    let sig = STANDARD.decode(sig)?;
+    let sig = MessageSignature::from_slice(&sig)?;
+    let secp = Secp256k1::verification_only();
+    let signed = sig.is_signed_by_address(&secp, &add, signed_msg_hash(msg))?;
+    match signed {
+        true => Ok(()),
+        false => Err(anyhow!("Failed signature check")),
+    }
+}
+
+pub(crate) fn check_integrity(file_path: &str, check: &str) -> Result<()> {
+    let f = File::open(file_path)?;
+    let mut reader = BufReader::new(f);
+    let mut engine = sha256::HashEngine::default();
+    std::io::copy(&mut reader, &mut engine)?;
+    let hash = sha256::Hash::from_engine(engine).to_string();
+    if hash == check {
+        Ok(())
+    } else {
+        Err(anyhow!(
+            "Integrity check failed! check: {} vs calculated: {}",
+            check,
+            hash
+        ))
+    }
+}

sphinx-key/src/core/control.rs

@@ -1,9 +1,9 @@
+use crate::bitcoin::Network;
 use crate::ID_LEN;
 use anyhow::{anyhow, Context, Result};
 use esp_idf_svc::nvs::{EspDefaultNvs, EspDefaultNvsPartition};
 use glyph::control::{Config, ControlPersist, Controller, FlashKey, Policy, Velocity};
 use glyph::ser::*;
-use sphinx_signer::lightning_signer::bitcoin::Network;
 use sphinx_signer::sphinx_glyph as glyph;
 use std::convert::TryInto;
 use std::sync::{Arc, Mutex};

sphinx-key/src/core/events.rs

@@ -3,13 +3,13 @@ use crate::core::lss;
 use crate::ota::{update_sphinx_key, validate_ota_message};
 use crate::status::Status;
 
+use crate::bitcoin::Network;
 use glyph::control::{Config, ControlMessage, ControlResponse, Controller, Policy, Velocity};
 use glyph::error::Error as GlyphError;
 use glyph::ser::{serialize_controlresponse, ByteBuf};
 use glyph::topics;
 use lss_connector::secp256k1::PublicKey;
 use sphinx_signer::approver::SphinxApprover;
-use sphinx_signer::lightning_signer::bitcoin::Network;
 //use sphinx_signer::lightning_signer::persist::DummyPersister;
 use sphinx_signer::kvv::{CloudKVVStore, FsKVVStore};
 use sphinx_signer::lightning_signer::persist::Persist;

sphinx-key/src/main.rs

@@ -1,3 +1,4 @@
+mod bitcoin_utils;
 mod button;
 mod conn;
 mod core;
@@ -6,6 +7,9 @@ mod ota;
 mod sd;
 mod status;
 
+pub(crate) use sphinx_signer::lightning_signer::bitcoin;
+
+use crate::bitcoin::Network;
 use crate::button::button_loop;
 use crate::core::control::controller_from_seed;
 use crate::core::{config::*, events::*, FlashPersister};
@@ -20,7 +24,6 @@ use esp_idf_svc::hal::peripherals::Peripherals;
 use esp_idf_svc::nvs::EspDefaultNvsPartition;
 #[allow(unused_imports)]
 use esp_idf_svc::sys as _;
-use sphinx_signer::lightning_signer::bitcoin::Network;
 use sphinx_signer::sphinx_glyph::control::{Config, ControlPersist, Policy, Velocity};
 use std::sync::{mpsc, Arc, Mutex};
 use std::thread;

sphinx-key/src/ota.rs

@@ -1,25 +1,17 @@
 use anyhow::{anyhow, Result};
-use base64::{engine::general_purpose::STANDARD, Engine as _};
 use esp_idf_svc::http::client::Configuration;
 use esp_idf_svc::http::client::EspHttpConnection;
 use esp_idf_svc::http::client::FollowRedirectsPolicy::FollowNone;
 use esp_idf_svc::http::Method;
 use esp_idf_svc::ota::EspOta;
 use log::{error, info};
-use sphinx_signer::lightning_signer::bitcoin::{
-    hashes::{sha256, Hash},
-    secp256k1::Secp256k1,
-    util::misc::{signed_msg_hash, MessageSignature},
-    Address,
-};
 use sphinx_signer::sphinx_glyph::control::OtaParams;
 use std::fs::{remove_file, File};
+use std::io::BufWriter;
 use std::io::Write;
-use std::io::{BufReader, BufWriter};
 
 const BUFFER_LEN: usize = 1024;
 const UPDATE_BIN_PATH: &str = "/sdcard/update.bin";
-const ADDRESS: &str = "1K51sSTyoVxHhKFtwWpzMZsoHvLshtw3Dp";
 
 fn factory_reset() -> Result<()> {
     let mut ota = EspOta::new()?;
@@ -70,32 +62,11 @@ fn get_update(params: &OtaParams) -> Result<()> {
 }
 
 fn check_signature(params: &OtaParams) -> Result<()> {
-    let add = ADDRESS.parse::<Address>()?;
-    let sig = STANDARD.decode(&params.message_sig)?;
-    let sig = MessageSignature::from_slice(&sig)?;
-    let secp = Secp256k1::verification_only();
-    let signed = sig.is_signed_by_address(&secp, &add, signed_msg_hash(&params.sha256_hash))?;
-    match signed {
-        true => Ok(()),
-        false => Err(anyhow!("Failed signature check")),
-    }
+    crate::bitcoin_utils::check_signature(&params.sha256_hash, &params.message_sig)
 }
 
 fn check_integrity(params: &OtaParams) -> Result<()> {
-    let f = File::open(UPDATE_BIN_PATH)?;
-    let mut reader = BufReader::new(f);
-    let mut engine = sha256::HashEngine::default();
-    std::io::copy(&mut reader, &mut engine)?;
-    let hash = sha256::Hash::from_engine(engine);
-    if hash.to_string() == params.sha256_hash {
-        Ok(())
-    } else {
-        Err(anyhow!(
-            "Integrity check failed! params: {} vs sdcard: {}",
-            params.sha256_hash,
-            hash.to_string()
-        ))
-    }
+    crate::bitcoin_utils::check_integrity(UPDATE_BIN_PATH, &params.sha256_hash)
 }
 
 pub fn update_sphinx_key(params: &OtaParams) -> Result<()> {