Hey guys, keraliss from walletscrutiny here. Thanks for the build instructions! We've created a simple verification script following your guidance and tested the reproducibility of the OneKey Pro firmware.

Here's the script we used:

#!/bin/bash
# Verification script for OneKey Pro firmware
set -e

# Create temp directory
TEMP_DIR="/tmp/onekey-basic"
rm -rf "${TEMP_DIR}"
mkdir -p "${TEMP_DIR}"
cd "${TEMP_DIR}"

# Clone and build
echo "Building firmware..."
git clone --depth 1 https://github.com/OneKeyHQ/firmware-pro.git
cd firmware-pro
git submodule update --init --recursive

# Build the firmware
chmod +x build-docker.sh
./build-docker.sh -f touch || true

# Find built firmware
BUILT_FIRMWARE=$(find . -name "firmware.bin" | grep "touch/firmware" | head -1)
if [ -z "${BUILT_FIRMWARE}" ]; then
  echo "Error: Could not find built firmware"
  exit 1
fi

# Download official firmware 
echo "Downloading firmware..."
wget -O downloaded.bin "https://github.com/OneKeyHQ/firmware-pro/releases/download/v4.12.0/pro.4.12.0-Stable-0225-5379167_thd89_app_PROD_20250221_1.1.5_dfc6ccf_0x10.signed.bin"

# Calculate checksums
echo "Calculating checksums..."
echo "RESULTS=========================================="
echo "Built firmware hash:"
sha256sum "${BUILT_FIRMWARE}"
echo "Downloaded firmware hash:"
sha256sum downloaded.bin
echo "================================================="

Our verification results show that the built firmware hash differs from the downloaded firmware:

Calculating checksums...
RESULTS==========================================
Built firmware hash:
2b8ce9dab486877b78ecfd9b7b5d0579e313197cb92e98f9bec20805072b7cdb  ./build/touch/firmware/firmware.bin
Downloaded firmware hash:
372fdf71a642e1797118fbd04a8df1b8f90c44cb8988f17c1e1ab85e6f0437cc  downloaded.bin
=================================================

We also analyzed the hexdump differences and found significant structural differences in the header and throughout the binary. The build logs show the firmware is built with a test vendor header (ONEKEY,FOR TEST ONLY) and has invalid signatures.

Based on these results, we've marked OneKey Pro as not-verifiable in our current review.

Are there any additional steps or specific build parameters we should use to get a build that would match the released firmware? In particular, we're interested in whether there's a way to reproduce the exact binary, or if certain signature areas need to be zeroed out to achieve a match?

waiting to hear from you!

Reproducible Builds Instructions 😊 #238

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions