amd-ucode-patch 1.0.1__tar.gz → 2.0.0__tar.gz

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/.github/workflows/build.yml

@@ -18,10 +18,10 @@ jobs:
   
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -58,4 +58,4 @@ jobs:
         path: dist/
 
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/.github/workflows/codeql.yml

@@ -48,7 +48,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -58,7 +58,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
       with:
         category: "/language:${{matrix.language}}"

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/.github/workflows/scorecard.yml

@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/.gitignore

@@ -1,2 +1,3 @@
 # Python
 __pycache__/
+dist/

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: amd-ucode-patch
-Version: 1.0.1
+Version: 2.0.0
 Summary: A Python library for parsing and interpreting AMD microcode patch files
 Project-URL: Homepage, https://github.com/amd-zenith/amd-ucode-patch
 Project-URL: Repository, https://github.com/amd-zenith/amd-ucode-patch
@@ -23,7 +23,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Hardware
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
-Requires-Dist: amd-cpuid==1.0.1
+Requires-Dist: amd-cpuid==1.0.2
 Requires-Dist: pycryptodome==3.23.0
 Requires-Dist: rich==15.0.0
 Description-Content-Type: text/markdown
@@ -47,35 +47,24 @@ pip install amd-ucode-patch
 
 ## Command line tools
 
-Installing the package provides the following command line tools.
+Installing the package provides the following command line tools. Run any tool
+with `--help` for usage details.
 
-### `amd_ucode_patch_info`
-
-Inspect one or more AMD microcode patch files and print their header
-information as a table.
-
-```bash
-amd_ucode_patch_info <files...> [-f {text,md,csv}]
-```
-
-Arguments:
-
-- `files`: One or more patch files to inspect. Glob patterns (e.g. `*.bin` or `**/*.bin`) are expanded automatically.
-- `-f`, `--format`: Output format. One of:
-  - `text` (default): A table rendered for the terminal.
-  - `md`: A Markdown table.
-  - `csv`: Comma separated values.
-
-For every patch file the following fields are reported: file name, date, update revision, loader ID, processor revision, CPUID, family, model, stepping, autorun, encrypted and body size.
+| Tool                   | Description                                                                            |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `amd_ucode_patch_info` | Inspect patch files and print their decoded fields as a table (text, Markdown or CSV). |
+| `amd_ucode_patch_sign` | Inspect, verify (`verify`) and re-sign (`resign`) patch signatures.                    |
 
 ## Library usage
 
 The package can also be used programmatically:
 
 ```python
-from amd_ucode_patch.parse import ucode_patch_parse
+from pathlib import Path
+from amd_ucode_patch.structures.patch import Patch
 
-patch = ucode_patch_parse("firmware.bin")
-print(patch.header.cpuid_str)
-print(patch.header.update_revision)
+patch = Patch.from_file(Path("firmware.bin"))
+print(patch.header.patch_level)                          # e.g. 0a000033
+print(f"{patch.header.data.cpuid.cpuid_signature:08X}")  # e.g. 00A00F00
+print(patch.name_canonical)                              # canonical filename
 ```

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/README.md

@@ -17,35 +17,24 @@ pip install amd-ucode-patch
 
 ## Command line tools
 
-Installing the package provides the following command line tools.
+Installing the package provides the following command line tools. Run any tool
+with `--help` for usage details.
 
-### `amd_ucode_patch_info`
-
-Inspect one or more AMD microcode patch files and print their header
-information as a table.
-
-```bash
-amd_ucode_patch_info <files...> [-f {text,md,csv}]
-```
-
-Arguments:
-
-- `files`: One or more patch files to inspect. Glob patterns (e.g. `*.bin` or `**/*.bin`) are expanded automatically.
-- `-f`, `--format`: Output format. One of:
-  - `text` (default): A table rendered for the terminal.
-  - `md`: A Markdown table.
-  - `csv`: Comma separated values.
-
-For every patch file the following fields are reported: file name, date, update revision, loader ID, processor revision, CPUID, family, model, stepping, autorun, encrypted and body size.
+| Tool                   | Description                                                                            |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `amd_ucode_patch_info` | Inspect patch files and print their decoded fields as a table (text, Markdown or CSV). |
+| `amd_ucode_patch_sign` | Inspect, verify (`verify`) and re-sign (`resign`) patch signatures.                    |
 
 ## Library usage
 
 The package can also be used programmatically:
 
 ```python
-from amd_ucode_patch.parse import ucode_patch_parse
+from pathlib import Path
+from amd_ucode_patch.structures.patch import Patch
 
-patch = ucode_patch_parse("firmware.bin")
-print(patch.header.cpuid_str)
-print(patch.header.update_revision)
+patch = Patch.from_file(Path("firmware.bin"))
+print(patch.header.patch_level)                          # e.g. 0a000033
+print(f"{patch.header.data.cpuid.cpuid_signature:08X}")  # e.g. 00A00F00
+print(patch.name_canonical)                              # canonical filename
 ```

{amd_ucode_patch-1.0.1 → amd_ucode_patch-2.0.0}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling==1.30.1", "hatch-vcs==0.5.0"]
+requires = ["hatchling==1.32.0", "hatch-vcs==0.5.0"]
 build-backend = "hatchling.build"
 
 [project]
@@ -30,7 +30,7 @@ classifiers = [
     "Topic :: Utilities",
 ]
 dependencies = [
-  "amd-cpuid==1.0.1",
+  "amd-cpuid==1.0.2",
   "pycryptodome==3.23.0",
   "rich==15.0.0",
 ]
@@ -49,3 +49,7 @@ source = "vcs"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/amd_ucode_patch"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

amd_ucode_patch-2.0.0/src/amd_ucode_patch/cli/argtypes.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+Argparse ``type=`` converters for hex-encoded key material shared by the
+command line tools. Each raises ``argparse.ArgumentTypeError`` on malformed or
+wrong-length input, which argparse renders as a usage error.
+"""
+
+import argparse
+
+
+def parse_fixed_hex(value: str, nbytes: int, what: str) -> bytes:
+    """
+    Parse ``value`` as hex (an optional ``0x`` prefix is allowed) and require it
+    to decode to exactly ``nbytes`` bytes. ``what`` names the field in error
+    messages.
+    """
+    text = value.strip().lower()
+    if text.startswith("0x"):
+        text = text[2:]
+    try:
+        data = bytes.fromhex(text)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"{what} must be hexadecimal, got {value!r}")
+    if len(data) != nbytes:
+        raise argparse.ArgumentTypeError(f"{what} must be {nbytes} bytes ({2 * nbytes} hex chars), got {len(data)}")
+    return data
+
+
+def parse_key(value: str) -> bytes:
+    """Parse a 16-byte AES-128 CMAC key from hex."""
+    return parse_fixed_hex(value, 16, "key")
+
+
+def parse_modulus(value: str) -> bytes:
+    """Parse a 256-byte RSA modulus from hex."""
+    return parse_fixed_hex(value, 256, "modulus")
+
+
+def parse_private(value: str) -> bytes:
+    """Parse a 256-byte RSA private exponent from hex."""
+    return parse_fixed_hex(value, 256, "private exponent")
+
+
+def parse_check(value: str) -> bytes:
+    """Parse a 256-byte signature check (Montgomery helper) field from hex."""
+    return parse_fixed_hex(value, 256, "check")

amd_ucode_patch-2.0.0/src/amd_ucode_patch/cli/info.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+A command line tool to print information about AMD uCode patch files.
+
+A format with no header-data model of its own still parses, with the fields
+only that format defines left empty.
+"""
+
+import argparse
+import csv
+import sys
+
+from rich import box
+from rich.console import Console
+from rich.table import Table
+
+from amd_ucode_patch.cli.banner import BANNER
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.structures.header_data import HeaderData
+from amd_ucode_patch.structures.patch import Patch
+
+#: Columns follow the order of the fields in the patch: the prologue, then the
+#: header data in offset order, then the signature block and the body header,
+#: with derived values shown next to the field they come from.
+COLS = ["File", "Date", "Patch level", "Loader ID", "Triads", "Init",
+        "Checksum", "CPUID", "Signed", "Encrypted", "Body PL", "Size"]
+
+#: Shown wherever a field is not defined by the patch's format.
+_NA = "-"
+
+
+def _field(data: HeaderData, name: str) -> object | None:
+    """A header-data field, or ``None`` when this format does not model it."""
+    return getattr(data, name, None)
+
+
+def _checksum_matches(data: HeaderData, raw: bytes) -> bool | None:
+    """
+    Whether the stored checksum matches the content it covers, or ``None`` when
+    this format has no checksum or the patch is too short to compute one.
+    """
+    stored = _field(data, "op_triad_checksum")
+    compute = getattr(data, "compute_op_triad_checksum", None)
+    if stored is None or compute is None:
+        return None
+    try:
+        return compute(raw) == stored
+    except ValueError:
+        return None
+
+
+def _row_fields(path, raw: bytes) -> tuple[tuple[str, ...], dict[str, str]]:
+    """
+    One table row for ``path``, filling what the patch's format supports, plus a
+    map of column -> "green"/"red" for the cells whose value is cross-checked.
+    """
+    patch = Patch.from_bytes(raw)
+    header = patch.header
+    data = header.data
+    body_header = patch.body.body_header
+
+    triads = _field(data, "op_triad_count")
+    # The same "run the patch on load" signal lives in the pre-Zen header data
+    # (``init_flag``) and in the Zen body header; show whichever one this format
+    # carries.
+    init = _field(data, "init_flag")
+    if init is None and body_header is not None:
+        init = body_header.init_flag
+    checksum = _field(data, "op_triad_checksum")
+    cpuid = _field(data, "cpuid")
+    pl_family = header.patch_level.family
+    # ``encrypted`` and the mirrored patch level live only in the body header.
+    encrypted = body_header.encrypted if body_header is not None else None
+    body_pl = body_header.patch_level if body_header is not None else None
+
+    cells = (
+        str(path),
+        str(header.date),
+        f"{header.patch_level} (fam {pl_family:#04x})",
+        str(header.loader_id),
+        str(triads) if triads is not None else _NA,
+        ("yes" if init else "no") if init is not None else _NA,
+        f"{checksum:08x}" if checksum is not None else _NA,
+        f"{cpuid.ucode_signature:04x} ({cpuid.description})"
+        if cpuid is not None else _NA,
+        "yes" if header.signature is not None else "no",
+        ("yes" if encrypted else "no") if encrypted is not None else _NA,
+        str(body_pl) if body_pl is not None else _NA,
+        str(len(raw)),
+    )
+
+    colours: dict[str, str] = {}
+    # Flag the known-malformed patch levels red; every other one is well-formed.
+    colours["Patch level"] = (
+        "red" if header.patch_level.is_anomalous else "green"
+    )
+    checksum_ok = _checksum_matches(data, raw)
+    if checksum_ok is not None:
+        colours["Checksum"] = "green" if checksum_ok else "red"
+    # Cross-check the patch level against the header's CPUID field. Newer patch
+    # levels pack the whole CPUID, so the whole signature is checked; older ones
+    # carry only the family, so just that is.
+    pl_cpuid = header.patch_level.cpuid
+    if cpuid is not None:
+        if pl_cpuid is not None:
+            matches = pl_cpuid.ucode_signature == cpuid.ucode_signature
+        else:
+            matches = pl_family == cpuid.family
+        colours["CPUID"] = "green" if matches else "red"
+    if body_pl is not None:
+        # The body header's patch level should mirror the header's.
+        matches = body_pl.value == header.patch_level.value
+        colours["Body PL"] = "green" if matches else "red"
+    return cells, colours
+
+
+def _rows(paths):
+    """
+    Build a row per readable patch, with its checksum verdict.
+
+    Diagnostics go to stderr so that piping the table or the CSV somewhere
+    yields only the data.
+    """
+    console = Console(stderr=True)
+    unmodelled = 0
+    for path in paths:
+        try:
+            raw = path.read_bytes()
+            cells, colours = _row_fields(path, raw)
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error parsing {path}: {exc}")
+            continue
+        unmodelled += cells[COLS.index("Triads")] == _NA
+        yield cells, colours
+    if unmodelled:
+        console.log(f"{unmodelled} file(s): that format has no header-data "
+                    f"model of its own, so only shared fields are shown")
+
+
+def _apply_colours(cells: tuple[str, ...], colours: dict[str, str]) -> list[str]:
+    """Wrap each cross-checked cell in its verdict colour (green/red)."""
+    out = list(cells)
+    for column, colour in colours.items():
+        index = COLS.index(column)
+        out[index] = f"[{colour}]{out[index]}[/{colour}]"
+    return out
+
+
+def print_table(console: Console, paths, format):
+    table = Table(*COLS, box=format)
+    for cells, colours in _rows(paths):
+        table.add_row(*_apply_colours(cells, colours))
+    console.print(table)
+
+
+def print_csv(paths):
+    """
+    Write the rows as CSV to stdout.
+
+    Written with :mod:`csv` rather than through the console: cell values contain
+    commas (a processor description, for one), and machine-readable output
+    should carry neither console formatting nor the checksum colouring.
+    """
+    writer = csv.writer(sys.stdout, lineterminator="\n")
+    writer.writerow(COLS)
+    writer.writerows(cells for cells, _ in _rows(paths))
+
+
+def main():
+    console = Console()
+
+    parser = argparse.ArgumentParser(description="Inspect AMD microcode patch files.")
+    parser.add_argument("files", nargs="+", help="Patch files to inspect")
+    parser.add_argument("-f", "--format", choices=["text", "md", "csv"], default="text")
+    args = parser.parse_args()
+
+    if args.format != "csv":
+        console.print(BANNER, highlight=False)
+
+    paths = expand_paths(args.files)
+    if args.format == "text":
+        print_table(console, paths, box.HEAVY_HEAD)
+    elif args.format == "md":
+        print_table(console, paths, box.MARKDOWN)
+    elif args.format == "csv":
+        print_csv(paths)
+
+
+if __name__ == "__main__":
+    main()

amd_ucode_patch-2.0.0/src/amd_ucode_patch/cli/paths.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""Shared path handling for the command line tools."""
+
+import glob
+from pathlib import Path
+from collections.abc import Iterable, Iterator
+
+
+def expand_paths(patterns: Iterable[str]) -> Iterator[Path]:
+    """
+    Expand each glob pattern into the matching paths (sorted, recursive ``**``
+    supported). A pattern with no matches is yielded verbatim as a ``Path`` so the
+    caller can surface a sensible "file not found" error.
+    """
+    for pattern in patterns:
+        matches = sorted(glob.glob(pattern, recursive=True))
+        if not matches:
+            yield Path(pattern)
+            continue
+        for match in matches:
+            yield Path(match)

amd_ucode_patch-2.0.0/src/amd_ucode_patch/cli/sign.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+A command line tool to verify and resign AMD uCode patch signatures.
+"""
+
+import sys
+import argparse
+from pathlib import Path
+
+from rich import box
+from rich.console import Console
+from rich.table import Table
+
+from amd_ucode_patch.cli.argtypes import parse_key, parse_modulus, parse_private
+from amd_ucode_patch.cli.banner import BANNER
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.structures.patch import Patch
+from amd_ucode_patch.structures.signature_fam17plus import SignatureFam17Plus
+from amd_ucode_patch.utils.cmac import cmac_digest
+from amd_ucode_patch.utils.entrysign import produce_colliding_key
+from amd_ucode_patch.utils.rsa import montgomery_n_prime, sign_pkcs1_v15_payload
+
+COLS = ["File", "Signed", "Digest", "Valid"]
+
+
+def _verify_row(path: Path, key: bytes | None) -> tuple[str, ...]:
+    """The four display cells (File, Signed, Digest, Valid) for one patch."""
+    patch = Patch.from_bytes(path.read_bytes())
+    signature = patch.header.signature
+
+    if signature is None:
+        return (str(path), "[yellow]no[/yellow]", "", "[dim]n/a[/dim]")
+
+    if not isinstance(signature, SignatureFam17Plus):
+        # A signature slot that is not the RSA block (family 0x16): present, but
+        # nothing to recover or verify.
+        return (str(path), "[green]yes[/green]", "[dim]not RSA[/dim]",
+                "[dim]n/a[/dim]")
+
+    recovered = signature.recover_digest()
+    digest = recovered.hex() if recovered is not None else "[red]<bad padding>[/red]"
+
+    if key is None:
+        return (str(path), "[green]yes[/green]", digest, "[dim]not checked[/dim]")
+
+    verified = patch.signature_verifies(key)
+    valid = "[green]yes[/green]" if verified else "[red]no[/red]"
+    return (str(path), "[green]yes[/green]", digest, valid)
+
+
+def verify(args, console: Console) -> None:
+    """The ``verify`` command: print a signature table for each file."""
+    table = Table(*COLS, box=box.HEAVY_HEAD)
+    for path in expand_paths(args.files):
+        try:
+            table.add_row(*_verify_row(path, args.key))
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error reading {path}: {exc}")
+    console.print(table)
+
+
+def _resign_one(
+    path: Path,
+    key: bytes,
+    private: bytes | None,
+    modulus: bytes | None,
+    output: Path | None,
+) -> tuple[Path, str]:
+    """Resign one patch, returning where it was written and the signed digest."""
+    patch = Patch.from_bytes(path.read_bytes())
+    signature = patch.header.signature
+    if not isinstance(signature, SignatureFam17Plus):
+        raise ValueError("patch has no RSA signature to resign")
+
+    digest = cmac_digest(patch.body.to_bytes(), key)
+    if private is None:
+        # No private key given.
+        # Forge a modulus that collides to the CMAC the
+        # loader expects, the way zentool does for the EntrySign exploit.
+        target = cmac_digest(signature.modulus, key)
+        new_modulus, new_private = produce_colliding_key(target, cmac_key=key)
+    else:
+        new_modulus = modulus if modulus is not None else signature.modulus
+        new_private = private
+
+    signature.modulus = new_modulus
+    signature.check = montgomery_n_prime(new_modulus)
+    signature.signature = sign_pkcs1_v15_payload(digest, new_modulus, new_private)
+
+    out_path = output if output is not None else path
+    out_path.write_bytes(patch.to_bytes())
+    return out_path, digest.hex()
+
+
+def resign(args, console: Console) -> int:
+    """
+    The ``resign`` command: re-sign edited patches, in place by default.
+
+    Returns a process exit code, non-zero if any file failed or the arguments
+    were invalid.
+    """
+    if args.output is not None and len(args.files) != 1:
+        console.log("Error: --output is only allowed with a single input file")
+        return 1
+    if args.modulus is not None and args.private is None:
+        console.log("Error: --modulus requires --private")
+        return 1
+
+    exit_code = 0
+    for path in expand_paths(args.files):
+        try:
+            target, digest = _resign_one(
+                path, args.key, args.private, args.modulus, args.output
+            )
+            console.print(f"[green]resigned[/green] {target} digest={digest}")
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error resigning {path}: {exc}")
+            exit_code = 1
+    return exit_code
+
+
+def main():
+    console = Console()
+    console.print(BANNER, highlight=False)
+
+    parser = argparse.ArgumentParser(
+        description="Inspect, verify, sign and resign AMD microcode patch signatures.",
+        epilog="The published Zen 1-4 CMAC key is 2b7e151628aed2a6abf7158809cf4f3c.",
+    )
+    subparsers = parser.add_subparsers(dest="command")
+
+    verify_parser = subparsers.add_parser("verify", help="Inspect signatures, and verify against the body with -k")
+    verify_parser.add_argument("files", nargs="+", help="Patch files to inspect")
+    verify_parser.add_argument("-k", "--key", type=parse_key, default=None, help="AES-128 CMAC key as 32 hex chars. Enables body verification.")
+
+    resign_parser = subparsers.add_parser("resign", help="Re-sign edited patches in-place (zentool-style)")
+    resign_parser.add_argument("files", nargs="+", help="Patch files to resign")
+    resign_parser.add_argument("-k", "--key", type=parse_key, required=True, help="AES-128 CMAC key as 32 hex chars")
+    resign_parser.add_argument("-d", "--private", type=parse_private, default=None, help="RSA private exponent as 512 hex chars (256 bytes). Optional.")
+    resign_parser.add_argument("-m", "--modulus", type=parse_modulus, default=None, help="RSA modulus as 512 hex chars (256 bytes). Used with --private.")
+    resign_parser.add_argument("-o", "--output", type=Path, default=None, help="Output file (single-input only). Defaults to in-place rewrite")
+
+    args = parser.parse_args()
+
+    if args.command == "verify":
+        verify(args, console)
+    elif args.command == "resign":
+        sys.exit(resign(args, console))
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()