Add firmware signing and verification

src/flash.c

@@ -2,6 +2,10 @@
 #include "flash.h"
 #include "log.h"
 #include "ota.h"
+#ifdef MG_OTA_PUBLIC_KEY
+#include "sha256.h"
+#include "tls_uecc.h"
+#endif
 
 #if MG_OTA != MG_OTA_NONE && MG_OTA != MG_OTA_CUSTOM
 
@@ -59,6 +63,18 @@ bool mg_ota_flash_end(struct mg_flash *flash) {
     if (size == s_size && crc32 == s_crc32) ok = true;
     MG_DEBUG(("CRC: %x/%x, size: %lu/%lu, status: %s", s_crc32, crc32, s_size,
               size, ok ? "ok" : "fail"));
+#ifdef MG_OTA_PUBLIC_KEY
+    if (ok && s_size > 64) {
+      static const uint8_t s_pubkey[] = MG_OTA_PUBLIC_KEY;
+      uint8_t hash[32];
+      size_t fw_size = s_size - 64;
+      mg_sha256(hash, (uint8_t *) base, fw_size);
+      ok = mg_uecc_verify(s_pubkey, hash, sizeof(hash),
+                          (uint8_t *) base + fw_size,
+                          mg_uecc_secp256r1()) == 1;
+      MG_INFO(("Signature: %s", ok ? "ok" : "fail"));
+    }
+#endif
     s_size = 0;
     if (ok) ok = flash->swap_fn();
   }