bpak 1.0.1__tar.gz

bpak-1.0.1/.gitattributes

@@ -0,0 +1,2 @@
+# Golden sets must stay byte identical, never convert line endings
+test/golden/*/** -text

bpak-1.0.1/.gitignore

@@ -0,0 +1,20 @@
+# Build directories, e.g. build/ and build-minimal/
+/build*/
+/dist/
+.venv/
+__pycache__/
+
+# Coverage report, see docs/development.md
+/coverage.info
+/coverage_report/
+
+# Coverity Scan, see .github/workflows/build.yml
+/cov-int/
+
+# Packages created when trying the tool in the repository root
+/*.bpak
+
+# Editors
+*~
+*.bak
+tags

bpak-1.0.1/CHANGELOG.md

@@ -0,0 +1,202 @@
+# Changelog
+
+Changes that affect users of the library, the python package and the `bpak`
+tool. The package format and the library ABI stay compatible, see
+[Compatibility](docs/development.md#compatibility). The SONAME of the
+shared library follows the major version.
+
+## 1.0.1 (2026-11-08)
+
+The upload of 1.0.0 to PyPI failed, 1.0.1 is the first release on PyPI.
+
+### Fixed
+
+- `bpak extract` to stdout and `bpak show --binary-hash` exited with 120
+  and printed `Exception ignored ... BrokenPipeError` when the reader of the
+  output exited, for example in `bpak extract demo.bpak --part fs | head -c
+  16`. They exit with 1 without a message, like the other commands.
+
+## 1.0.0 (2026-10-29)
+
+### Added
+
+- The python package with the `bpak` tool is published on PyPI,
+  `pip install bpak`, with wheels for Linux on x86_64 and aarch64.
+- `bpak set --part-ref` changes meta data that refers to a part, for
+  example `pb-load-addr`. `set` could only change meta data without a part
+  reference.
+- `bpak_id_to_string` knows `bpak-key-id` and `bpak-key-store`, which
+  `bpak show` prints as the names of such meta data.
+- `bpak.transport_encode` and `bpak.transport_decode` accept `origin=None`
+  for packages without diff based encoders.
+
+### Changed
+
+- The SONAME of the shared library is `libbpak.so.1`. The ABI is compatible
+  with 0.9, but programs linked against `libbpak.so.0` have to be linked
+  again.
+- The `bpak` tool is implemented in python and is part of the `bpak` python
+  package, install it with `pip install .` or `uv tool install .`. The C
+  implementation in `src/` is removed. Commands and options are unchanged,
+  but usage errors exit with 2, and `bpak compare` marks parts that only
+  exist in the second package with `+` instead of `-`.
+- The python wrapper is the `bpak` python package, built with
+  scikit-build-core and CMake. It links the library statically, requires
+  Python 3.10 or later and is typed. It replaces `python/setup.py`.
+- The documentation is Markdown in `docs/`, which replaces Sphinx and Read
+  the Docs. The public headers document the complete C API.
+- libuuid is no longer a build dependency.
+- `version.txt` holds the version.
+- The python package declares and ships the licenses of the third-party
+  code, see `LICENSES/`.
+- Programs that are compiled with other mbedtls headers than the library
+  fail to compile, `struct bpak_hash_context` contains the mbedtls contexts.
+- `bpak_printf` is declared with the `format(printf)` attribute, compilers
+  check the arguments of calls to it.
+- `bpak/heatshrink_decoder.h` only defines the decoder state that
+  `struct bpak_bspatch_context` embeds. The declarations of the heatshrink
+  functions, which the library does not export, and `HEATSHRINK_USE_INDEX`
+  are removed.
+- `Part.id`, `Meta.id` and `Meta.part_id_ref` of the python package are
+  read-only. Add the part or meta data again to change its id.
+- `Package.digest` raises the error of `Package.update_hash()` instead of
+  returning `None`.
+
+### Fixed
+
+- Merkle tree verification compared only the first byte of the root hash.
+- Verifying a package against a keystore with an RSA key crashed.
+- A patch was not detected when applied to an origin from another package.
+- Opening a file smaller than a header that is not a package wrote a header
+  into it.
+- Keystores contained stack memory in the padding after keys.
+- `bpak_bin2hex` and `bpak show` could overflow a buffer.
+- Extracting a transport encoded part truncated it.
+- `bpak transport` used an uninitialized origin without `--origin`.
+- `bpak generate keystore` wrote trailing spaces, and a line with only spaces
+  after keys whose size is a multiple of 8, for example secp384r1 keys.
+- `bpak_verify_compute_header_hash` ignored errors.
+- A failed `bpak_add_meta` left a meta data entry in the header, and
+  `bpak_pkg_write_raw_signature` could overflow the signature field.
+- Memory leaks when loading keys with mbedtls, and compiler warnings in 32-bit
+  builds.
+- A patch with negative lengths in its control data overflowed buffers when
+  it was applied, for example with `bpak transport --decode`. Such patches
+  fail with `BPAK_SIZE_ERROR`, as do patches that seek before the origin.
+- `bpak_pkg_verify` read past the signature field when the signature size in
+  the header was larger than the field, it fails with `BPAK_SIZE_ERROR`.
+- Deleting meta data, for example with `bpak delete --part`, corrupted the
+  value of the following meta data when it was larger than the deleted one,
+  and with 32 meta data entries it cleared the first part header.
+- `bpak_valid_header` accepted parts and meta data after an empty slot, which
+  the lookups find, unaligned meta data, part sizes that overflow and
+  signature sizes larger than the signature field. The payload hash and
+  transport decoding did not validate the header. Lookups of id 0 found
+  empty slots.
+- bspatch computed offsets that overflow `off_t` from large lengths in a
+  patch, such patches fail with `BPAK_SIZE_ERROR`.
+- Transport decoding wrote past the part that it decoded and read past the
+  origin part when the patch, the copied data or the merkle hash tree was
+  larger than the part.
+- `bpak_calloc`, `bpak_free` and `bpak_transport_encode` were declared in
+  the public headers but not exported by the shared library.
+- With an allocator from `bpak_set_calloc_free`, the lzma encoder and
+  decoder freed memory from `malloc` with it. The lzma decoder may use at
+  most 64 MiB (`BPAK_BSPATCH_LZMA_MEMLIMIT`), it had no limit.
+- `bpak_pkg_add_key` and the python package freed keys with `free` instead
+  of `bpak_free`.
+- `bpak_meta_to_string` did not terminate a `bpak-version` that filled the
+  buffer, left the buffer uninitialized when it was too small for a hash and
+  read the values of known meta data regardless of their size. `bpak show`
+  prints `<invalid>` for values that are too small for their type.
+- Transport decoding compares the merkle root hash of a generated hash tree
+  with `merkle-root-hash` and fails with `BPAK_BAD_ROOT_HASH`, and the sizes
+  of the merkle salt and root hash are checked. `bpak transport --decode`
+  printed the offset of the merkle tree.
+- `bpak_merkle_init` rejected data of 8 GiB to 1 TiB, which
+  `bpak_merkle_compute_size` accepts, so adding such a file with
+  `--encoder merkle` crashed. Earlier versions can not verify these
+  packages. `bpak_merkle_write_chunk` wrote past the hash tree when it got
+  more data than the tree was created for, it fails with `BPAK_SIZE_ERROR`.
+- Every package created with `--encoder merkle` had the same merkle salt,
+  it came from `random()`, which was never seeded.
+- Transport decoding leaked the lzma decoder when a patch failed in the
+  middle of a part, `bpak_transport_decode_free` frees it now.
+- Adding a part: a file that could not be read, for example a directory,
+  or that changed size made `bpak_pkg_add_file` loop forever, a part added
+  after a transport encoded part was written at the wrong offset, and a
+  failed add left the part in the package. `bpak add --encoder merkle`
+  computed the hash tree from the file instead of the added data, which
+  overflowed a buffer when the file grew.
+- Deleting a part looped forever when the file had data after the last part
+  or ended before it, moved the offsets of the following parts by the
+  transport size of a transport encoded part, and left the in-memory
+  header changed when it failed. A failed `bpak_pkg_open` left the closed
+  file in the package, and `filename` was never set.
+- `BPAK_DECLARE_STATIC_KEY` stored the key in a byte array, which is not
+  aligned for `struct bpak_key`.
+- The mbedtls backend ignored the results of the hash functions and of
+  parsing key files, did not check an allocation when it loaded a public
+  key, leaked the key when verification could not parse it and left the
+  private key in a stack buffer.
+- `bpak_pkg_sign` signed directly into the header, a failure left it with a
+  cleared signature, and the private key was not cleared before it was
+  freed. It sets the signature kind of the header to the kind of the key,
+  which was not checked.
+- `bpak_keystore_load_key_from_file` verifies the payload hash of the
+  keystore and fails with `BPAK_BAD_PAYLOAD_HASH` when it is corrupted, it
+  read `keystore-provider-id` regardless of its size, and returns
+  `BPAK_KEY_NOT_FOUND` instead of `BPAK_NOT_FOUND` when the keystore does
+  not contain the key. `bpak verify --keystore` exits with the code of
+  `BPAK_KEY_NOT_FOUND` (228) for an unknown key instead of 254.
+- File offsets were passed to `fseek` as `long`, packages larger than 2 GiB
+  did not work on targets with a 32-bit `long`. Programs that are compiled
+  with another size of `off_t` than the library fail to compile, see
+  [the C library](docs/c-library.md), and `bpak/bpak.h` compiles with
+  `-std=c99`.
+- The static library defined the functions of heatshrink and sais without a
+  prefix, which clashed with programs that use heatshrink themselves.
+- `bpak_pkg_size` and `bpak_pkg_installed_size` wrapped around when the size
+  does not fit `size_t`, they return `SIZE_MAX`.
+- `bpak_pkg_transport_decode` and `bpak.transport_decode` cleared the
+  transport flags in the header of the input package instead of the output
+  package, so the input package reported the wrong sizes, and the output
+  package kept the header it was opened with until it was opened again.
+- bsdiff truncated the length of matches to 32 bits, a match longer than
+  2 GiB made `bpak transport --encode` scan backwards.
+- `bpak_pkg_delete_part`, and with it `bpak delete --part` and
+  `Package.delete_part`, left the `<part>-hash-tree` part of a part added
+  with a merkle hash tree in the package. It deletes the hash tree part as
+  well.
+- `bpak_transport_encode`, and with it `bpak transport --encode --origin`,
+  crashed when the origin or the input package had no `bpak-package` meta
+  data, and read past a `bpak-package` that is smaller than a UUID. It fails
+  with `BPAK_NOT_FOUND` and `BPAK_SIZE_ERROR` like transport decoding.
+- Log messages of the library used printf formats that do not match their
+  arguments, they printed wrong values, for example in 32-bit builds.
+- The public headers were not installed when the library is built as a
+  CMake subproject with `add_subdirectory`.
+- `bpak/key.h` did not compile unless `bpak/bpak.h` was included first.
+- `bpak_transport_encode` returned -1 instead of an error code when a seek
+  or the header write failed and for an unknown encoder, which is
+  `BPAK_NOT_SUPPORTED` now: `bpak transport --encode` exits with 249 instead
+  of 255 for an encoder that `bpak transport --add` added but that does not
+  exist.
+- Python package: crashes when opening a file that is not a package, when
+  using a closed package and after the log callback was released, reference
+  leaks in `Package.parts` and `Package.meta`, meta data larger than the
+  meta data area overflowed the header, empty parts could not be read, and
+  short reads, errors in the log function and failed header writes when
+  clearing the signature were not reported.
+- `bpak` tool: `delete --all --part`, file errors printed a traceback, file
+  names that are not UTF-8.
+- Python package: deleting an int attribute, for example `del pkg.key_id`,
+  crashed, and values that do not fit the field were truncated,
+  `pkg.hash_kind = 256` stored 0. Such values raise `OverflowError` and
+  deleting an attribute raises `TypeError`.
+- Python package: `Package.sign()` reported argument errors as `verify()`,
+  `Meta.as_uuid()` did not check that the `uuid` module has `UUID`, and the
+  docstring of `Package.meta` described the parts.
+- Python package: ids from `0x80000000` and sizes from 2 GiB were negative
+  or wrong on targets with a 32-bit `long`, and `repr()` of a part passed
+  its size as `int`.

bpak-1.0.1/CMakeLists.txt

@@ -0,0 +1,67 @@
+cmake_minimum_required(VERSION 3.10)
+
+# version.txt is the single source of the project version
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/version.txt" BPAK_VERSION LIMIT_COUNT 1)
+
+if (NOT BPAK_VERSION MATCHES "^[0-9]+\\.[0-9]+\\.[0-9]+$")
+    message(FATAL_ERROR
+        "version.txt must contain MAJOR.MINOR.PATCH, got '${BPAK_VERSION}'")
+endif()
+
+# Re-run cmake when the version changes
+set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS version.txt)
+
+project(bpak VERSION ${BPAK_VERSION}
+             DESCRIPTION BitPacker
+             HOMEPAGE_URL https://github.com/jonasblixt/bpak
+             LANGUAGES C
+)
+
+enable_testing()
+set(CMAKE_C_STANDARD 99)
+
+option(BPAK_BUILD_MINIMAL "Build a minimal version of the library" OFF)
+option(BPAK_BUILD_TESTS "Build test cases" OFF)
+option(BPAK_WERROR "Treat compiler warnings as errors" ON)
+option(BPAK_BUILD_FUZZERS "Build the libFuzzer targets, requires clang" OFF)
+
+add_compile_options(-Wall)
+if (BPAK_WERROR)
+    add_compile_options(-Werror)
+endif()
+
+if (NOT BPAK_BUILD_MINIMAL)
+    set(BPAK_CONFIG_MERKLE 1)
+    set(BPAK_CONFIG_LZMA 1)
+    set(BPAK_CONFIG_MBEDTLS 1)
+    find_library(MBEDCRYPTO_LIBRARY mbedcrypto REQUIRED)
+    find_library(LZMA_LIBRARY lzma REQUIRED)
+else()
+    set(BPAK_CONFIG_MBEDTLS 0)
+    set(BPAK_CONFIG_LZMA 0)
+    set(BPAK_CONFIG_MERKLE 0)
+endif()
+
+add_subdirectory("lib")
+
+# Test builds and python package builds with scikit-build-core, see
+# pyproject.toml, build the C extension
+if (BPAK_BUILD_TESTS OR SKBUILD)
+    add_subdirectory("tools")
+endif()
+
+if (BPAK_BUILD_TESTS)
+    # Python for the examples and the tests, tools/ finds it with the
+    # components that the C extension needs
+    find_package(Python 3.10 REQUIRED COMPONENTS Interpreter)
+    add_subdirectory("examples")
+    add_subdirectory("test")
+endif()
+
+# The fuzz targets, and their corpus as tests in test builds
+if (BPAK_BUILD_TESTS OR BPAK_BUILD_FUZZERS)
+    if (BPAK_BUILD_MINIMAL)
+        message(FATAL_ERROR "BPAK_BUILD_FUZZERS requires BPAK_BUILD_MINIMAL=OFF")
+    endif()
+    add_subdirectory("test/fuzz")
+endif()

bpak-1.0.1/LICENSE

@@ -0,0 +1,32 @@
+Bit Packer
+
+  SPDX-License-Identifier: BSD-3-Clause
+
+Copyright 2019, Jonas Blixt <jonpe960@gmail.com>
+
+Redistribution and use in source and binary forms, with or without modification, 
+    are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, 
+            this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, 
+    this list of conditions and the following disclaimer in the documentation 
+    and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors 
+    may be used to endorse or promote products derived from this software 
+    without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE 
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, 
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

bpak-1.0.1/LICENSES/bsdiff.txt

@@ -0,0 +1,24 @@
+Copyright 2003-2005 Colin Percival
+Copyright 2012 Matthew Endsley
+All rights reserved
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted providing that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

bpak-1.0.1/LICENSES/heatshrink.txt

@@ -0,0 +1,14 @@
+Copyright (c) 2013-2015, Scott Vokes <vokes.s@gmail.com>
+All rights reserved.
+ 
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+ 
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

bpak-1.0.1/LICENSES/sais-lite.txt

@@ -0,0 +1,24 @@
+sais.c for sais-lite
+Copyright (c) 2008-2010 Yuta Mori All Rights Reserved.
+Copyright (c) 2019, Erik Moqvist (Python wrapper).
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

bpak-1.0.1/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: bpak
+Version: 1.0.1
+Summary: Bitpacker, a tool and library for signed firmware archives
+Author-Email: Jonas Blixt <jonpe960@gmail.com>
+License-Expression: BSD-3-Clause AND BSD-2-Clause AND ISC AND MIT
+License-File: LICENSE
+License-File: LICENSES/bsdiff.txt
+License-File: LICENSES/heatshrink.txt
+License-File: LICENSES/sais-lite.txt
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Embedded Systems
+Classifier: Programming Language :: C
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Typing :: Typed
+Project-URL: Homepage, https://github.com/jonasblixt/bpak
+Project-URL: Documentation, https://github.com/jonasblixt/bpak/tree/master/docs
+Project-URL: Issues, https://github.com/jonasblixt/bpak/issues
+Requires-Python: >=3.10
+Requires-Dist: click<9,>=8.1
+Description-Content-Type: text/markdown
+
+<img src="https://raw.githubusercontent.com/jonasblixt/bpak/master/docs/bitpacker.svg" width="60" alt="bitpacker logo">
+
+# Bitpacker
+
+[![Build](https://github.com/jonasblixt/bpak/actions/workflows/build.yml/badge.svg)](https://github.com/jonasblixt/bpak/actions/workflows/build.yml)
+[![Coverity](https://scan.coverity.com/projects/20419/badge.svg)](https://scan.coverity.com/projects/jonasblixt-bpak)
+
+Bitpacker, or bpak, is a C library, a python package and a command line tool
+for signed firmware packages, primarily for embedded systems.
+
+An embedded system is often composed of several software components: a
+bootloader, a kernel, file systems, device configuration and applications,
+each with its own format and tools. A bpak package holds all of them as parts,
+together with meta data, in a format that a bootloader can verify:
+
+- **Signed packages.** ECDSA (P-256, P-384, P-521) or RSA 4096 signatures
+  over a sha256, sha384 or sha512 hash. Packages can be signed with keys on
+  disk during development, and release candidates can be signed again by an
+  external signing service or HSM without being rebuilt.
+- **Meta data.** Package type and version, load addresses or any
+  application specific data, protected by the signature.
+- **dm-verity.** Merkle hash trees for file system images, compatible with
+  the Linux dm-verity device mapper target.
+- **Small updates.** Packages can be transport encoded with binary diffs
+  against the installed version. The device decodes the update as it is
+  received and gets a package that is identical to the original, signature
+  included.
+- **Keystores.** Sets of public keys in a package, which can be compiled into
+  a bootloader or loaded at runtime to extend the root of trust.
+
+The library is small and depends neither on a file system nor on a
+particular crypto library, which makes it suitable for bootloaders, for
+example [punchboot](https://github.com/jonasblixt/punchboot).
+
+bpak is not a package manager. It provides the package format and the
+primitives to verify and update packages. How packages are installed is up
+to the system that uses them.
+
+## Installation
+
+The `bpak` tool is part of the bpak python package on
+[PyPI](https://pypi.org/project/bpak). Install it with
+[uv](https://docs.astral.sh/uv), which puts it in an isolated environment,
+or with pip:
+
+```
+$ uv tool install bpak
+$ pip install bpak
+```
+
+The package includes the library and requires Python 3.10 or later. There
+are wheels for Linux on x86_64 and aarch64. On other platforms, and when
+installed from the repository root with `pip install .`, the package is built
+with CMake, which needs a C compiler and the mbedtls and liblzma development
+packages, for example `libmbedtls-dev` and `liblzma-dev` on Debian and
+Ubuntu.
+
+Build and install the C library:
+
+```
+$ cmake -B build
+$ cmake --build build
+$ sudo cmake --install build
+```
+
+## Example
+
+```
+$ bpak create demo.bpak
+$ bpak add demo.bpak --meta bpak-version --from-string 1.0.0
+$ bpak add demo.bpak --part kernel --from-file kernel.bin
+$ bpak sign demo.bpak --key prime256v1-key-pair.pem
+$ bpak verify demo.bpak --key prime256v1-public-key.der
+Verification OK
+```
+
+## Documentation
+
+- [User guide](https://github.com/jonasblixt/bpak/blob/master/docs/user-guide.md): the `bpak` tool, step by step
+- [Package format](https://github.com/jonasblixt/bpak/blob/master/docs/format.md): parts, meta data, ids, signing and
+  transport encoding
+- [C library](https://github.com/jonasblixt/bpak/blob/master/docs/c-library.md): architecture, building and using the
+  library
+- [Python package](https://github.com/jonasblixt/bpak/blob/master/docs/python.md): the python API
+- [Development](https://github.com/jonasblixt/bpak/blob/master/docs/development.md): building, testing and contributing
+
+## License
+
+BSD-3-Clause, see [LICENSE](https://github.com/jonasblixt/bpak/blob/master/LICENSE). The library includes third-party code
+under other licenses, see [LICENSES](https://github.com/jonasblixt/bpak/tree/master/LICENSES):
+
+- binary diff and patch (`lib/bsdiff.c`, `lib/bspatch.c`), based on bsdiff
+  by Colin Percival and Matthew Endsley: BSD-2-Clause
+- heatshrink compression by Scott Vokes (`lib/vendor/heatshrink`): ISC
+- sais-lite suffix array construction by Yuta Mori (`lib/vendor/sais`): MIT

bpak-1.0.1/README.md

@@ -0,0 +1,95 @@
+<img src="https://raw.githubusercontent.com/jonasblixt/bpak/master/docs/bitpacker.svg" width="60" alt="bitpacker logo">
+
+# Bitpacker
+
+[![Build](https://github.com/jonasblixt/bpak/actions/workflows/build.yml/badge.svg)](https://github.com/jonasblixt/bpak/actions/workflows/build.yml)
+[![Coverity](https://scan.coverity.com/projects/20419/badge.svg)](https://scan.coverity.com/projects/jonasblixt-bpak)
+
+Bitpacker, or bpak, is a C library, a python package and a command line tool
+for signed firmware packages, primarily for embedded systems.
+
+An embedded system is often composed of several software components: a
+bootloader, a kernel, file systems, device configuration and applications,
+each with its own format and tools. A bpak package holds all of them as parts,
+together with meta data, in a format that a bootloader can verify:
+
+- **Signed packages.** ECDSA (P-256, P-384, P-521) or RSA 4096 signatures
+  over a sha256, sha384 or sha512 hash. Packages can be signed with keys on
+  disk during development, and release candidates can be signed again by an
+  external signing service or HSM without being rebuilt.
+- **Meta data.** Package type and version, load addresses or any
+  application specific data, protected by the signature.
+- **dm-verity.** Merkle hash trees for file system images, compatible with
+  the Linux dm-verity device mapper target.
+- **Small updates.** Packages can be transport encoded with binary diffs
+  against the installed version. The device decodes the update as it is
+  received and gets a package that is identical to the original, signature
+  included.
+- **Keystores.** Sets of public keys in a package, which can be compiled into
+  a bootloader or loaded at runtime to extend the root of trust.
+
+The library is small and depends neither on a file system nor on a
+particular crypto library, which makes it suitable for bootloaders, for
+example [punchboot](https://github.com/jonasblixt/punchboot).
+
+bpak is not a package manager. It provides the package format and the
+primitives to verify and update packages. How packages are installed is up
+to the system that uses them.
+
+## Installation
+
+The `bpak` tool is part of the bpak python package on
+[PyPI](https://pypi.org/project/bpak). Install it with
+[uv](https://docs.astral.sh/uv), which puts it in an isolated environment,
+or with pip:
+
+```
+$ uv tool install bpak
+$ pip install bpak
+```
+
+The package includes the library and requires Python 3.10 or later. There
+are wheels for Linux on x86_64 and aarch64. On other platforms, and when
+installed from the repository root with `pip install .`, the package is built
+with CMake, which needs a C compiler and the mbedtls and liblzma development
+packages, for example `libmbedtls-dev` and `liblzma-dev` on Debian and
+Ubuntu.
+
+Build and install the C library:
+
+```
+$ cmake -B build
+$ cmake --build build
+$ sudo cmake --install build
+```
+
+## Example
+
+```
+$ bpak create demo.bpak
+$ bpak add demo.bpak --meta bpak-version --from-string 1.0.0
+$ bpak add demo.bpak --part kernel --from-file kernel.bin
+$ bpak sign demo.bpak --key prime256v1-key-pair.pem
+$ bpak verify demo.bpak --key prime256v1-public-key.der
+Verification OK
+```
+
+## Documentation
+
+- [User guide](https://github.com/jonasblixt/bpak/blob/master/docs/user-guide.md): the `bpak` tool, step by step
+- [Package format](https://github.com/jonasblixt/bpak/blob/master/docs/format.md): parts, meta data, ids, signing and
+  transport encoding
+- [C library](https://github.com/jonasblixt/bpak/blob/master/docs/c-library.md): architecture, building and using the
+  library
+- [Python package](https://github.com/jonasblixt/bpak/blob/master/docs/python.md): the python API
+- [Development](https://github.com/jonasblixt/bpak/blob/master/docs/development.md): building, testing and contributing
+
+## License
+
+BSD-3-Clause, see [LICENSE](https://github.com/jonasblixt/bpak/blob/master/LICENSE). The library includes third-party code
+under other licenses, see [LICENSES](https://github.com/jonasblixt/bpak/tree/master/LICENSES):
+
+- binary diff and patch (`lib/bsdiff.c`, `lib/bspatch.c`), based on bsdiff
+  by Colin Percival and Matthew Endsley: BSD-2-Clause
+- heatshrink compression by Scott Vokes (`lib/vendor/heatshrink`): ISC
+- sais-lite suffix array construction by Yuta Mori (`lib/vendor/sais`): MIT