spsdk-el2go 0.2.0__tar.gz

spsdk_el2go-0.2.0/LICENSE

@@ -0,0 +1,32 @@
+
+
+BSD 3-Clause "New" or "Revised" License
+
+Copyright (c) 2026, NXP
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived from this
+  software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+

spsdk_el2go-0.2.0/MANIFEST.in

@@ -0,0 +1,7 @@
+include LICENSE
+include README.md
+
+recursive-include tests *
+recursive-exclude * __pycache__
+recursive-exclude * *.py[co]
+recursive-exclude .github *

spsdk_el2go-0.2.0/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.4
+Name: spsdk-el2go
+Version: 0.2.0
+Summary: SPSDK Service providers powered by EdgeLock2GO
+Author: NXP
+Maintainer-email: NXP <spsdk@nxp.com>
+License-Expression: BSD-3-Clause
+Project-URL: Homepage, https://github.com/nxp-mcuxpresso/spsdk_plugins/tree/master/el2go
+Project-URL: Issues, https://github.com/nxp-mcuxpresso/spsdk_plugins/issues
+Keywords: NXP,SPSDK,el2go
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: spsdk>2.1
+Requires-Dist: platformdirs
+Dynamic: license-file
+
+
+# EdgeLock 2 GO service providers for SPSDK
+
+Package contains multiple SPSDK service providers powered by EL2GO
+
+* Free software: BSD-3-Clause
+* Documentation: https://spsdk-el2go.readthedocs.io.
+
+
+Installation
+------------
+
+* Activate virtual env, where you have SPSDK
+    - if SPSDK is not installed, the latest one will be installed automatically from [PyPI](https://pypi.org/project/spsdk/)
+* `pip install spsdk-el2go`
+
+
+## Signature Provider
+
+Everywhere in SPSDK where a signature (private key) is required, a signature provider can be used instead.  
+Using this plugin, all signing operations can be delegated to EL2GO. Private keys stay securely stored in EL2GO servers.
+
+
+### Configuration:
+
+SPSDK Service providers are configured via a Service configuration string.
+Format: `type=<service_id>[;param1=value1][;param2=value2]`  
+In this case the service identifier is `el2go` thus the config string starts with `type=el2go`
+
+EL2GO signature provider uses the following configuration options:
+  * `url`: Base EL2GO API URL (default: https://api.edgelock2go.com)
+  * `api_key`: EL2GO API key. Can be placed in env variable (staring with $) or a file.
+    * E.g.: `~/.config/el2go/token.txt`, `$EL2GO_TOKEN`, `$PATH_TO_FILE_WITH_API_KEY`
+    * make sure your API token has Code Signing permissions set (both View and Manage are required)
+  * `key_set_id` (number): ID of the Key Set in EL2GO server
+  * `key_id` (number): ID of the key used for signing operation
+  * `config_path`: path to a YAML file containing some or all the config options above
+
+These configuration options can be specified in service configuration string
+
+    type=el2go;url=https://api.edgelock2go.com;api_key=~/.config/el2go/token.txt;key_set_id=4;key_id=1
+
+or can be passed via a config file
+
+    type=el2go;config_path=el2go_config.yaml
+
+or a combination of both, overriding/adding options from config file in config string:
+
+    type=el2go;config_path=el2go_config.yaml;key_id=2
+
+To help with setting up the config file, you may use `el2go-helper` application which is bundled with this python package.  
+Run `el2go-helper --help` to see more info.
+
+### Usage
+
+
+* Use the configuration string in any SPSDK YAML config file, where a private key is normally provided
+  * e.g.: in MBI config file: `signer: type=el2go;config_path=el2go_config.yaml`
+
+* Use SPSDK application as you would normally do
+  * e.g.: `nxpimage mbi export -c mbi_config.yaml`
+
+
+## SB Key derivation provider
+
+Derive encryption key used for SB3 and SB4 files from key stored in EdgeLock 2 GO server
+
+
+### Configuration
+
+Exactly the same as for Signature Provider
+
+
+### Usage
+
+* Use the configuration string in SB3 or SB4 YAML config file, where the CUST_MK_SK/SBKEK is provided
+  * e.g.: `containerKeyBlobEncryptionKey: type=el2go;config_path=el2go_config.yaml;key_id=20`
+
+* Use SPSDK's nxpimage application as you would normally do
+  * e.g.: `nxpimage sb31 export -c sb_config.yaml`
+
+## Public key provider
+
+Allow to specify any public key in YAML config file as a reference to public key stored in EdgeLock 2 GO
+
+**Coming soon**
+

spsdk_el2go-0.2.0/README.md

@@ -0,0 +1,87 @@
+
+# EdgeLock 2 GO service providers for SPSDK
+
+Package contains multiple SPSDK service providers powered by EL2GO
+
+* Free software: BSD-3-Clause
+* Documentation: https://spsdk-el2go.readthedocs.io.
+
+
+Installation
+------------
+
+* Activate virtual env, where you have SPSDK
+    - if SPSDK is not installed, the latest one will be installed automatically from [PyPI](https://pypi.org/project/spsdk/)
+* `pip install spsdk-el2go`
+
+
+## Signature Provider
+
+Everywhere in SPSDK where a signature (private key) is required, a signature provider can be used instead.  
+Using this plugin, all signing operations can be delegated to EL2GO. Private keys stay securely stored in EL2GO servers.
+
+
+### Configuration:
+
+SPSDK Service providers are configured via a Service configuration string.
+Format: `type=<service_id>[;param1=value1][;param2=value2]`  
+In this case the service identifier is `el2go` thus the config string starts with `type=el2go`
+
+EL2GO signature provider uses the following configuration options:
+  * `url`: Base EL2GO API URL (default: https://api.edgelock2go.com)
+  * `api_key`: EL2GO API key. Can be placed in env variable (staring with $) or a file.
+    * E.g.: `~/.config/el2go/token.txt`, `$EL2GO_TOKEN`, `$PATH_TO_FILE_WITH_API_KEY`
+    * make sure your API token has Code Signing permissions set (both View and Manage are required)
+  * `key_set_id` (number): ID of the Key Set in EL2GO server
+  * `key_id` (number): ID of the key used for signing operation
+  * `config_path`: path to a YAML file containing some or all the config options above
+
+These configuration options can be specified in service configuration string
+
+    type=el2go;url=https://api.edgelock2go.com;api_key=~/.config/el2go/token.txt;key_set_id=4;key_id=1
+
+or can be passed via a config file
+
+    type=el2go;config_path=el2go_config.yaml
+
+or a combination of both, overriding/adding options from config file in config string:
+
+    type=el2go;config_path=el2go_config.yaml;key_id=2
+
+To help with setting up the config file, you may use `el2go-helper` application which is bundled with this python package.  
+Run `el2go-helper --help` to see more info.
+
+### Usage
+
+
+* Use the configuration string in any SPSDK YAML config file, where a private key is normally provided
+  * e.g.: in MBI config file: `signer: type=el2go;config_path=el2go_config.yaml`
+
+* Use SPSDK application as you would normally do
+  * e.g.: `nxpimage mbi export -c mbi_config.yaml`
+
+
+## SB Key derivation provider
+
+Derive encryption key used for SB3 and SB4 files from key stored in EdgeLock 2 GO server
+
+
+### Configuration
+
+Exactly the same as for Signature Provider
+
+
+### Usage
+
+* Use the configuration string in SB3 or SB4 YAML config file, where the CUST_MK_SK/SBKEK is provided
+  * e.g.: `containerKeyBlobEncryptionKey: type=el2go;config_path=el2go_config.yaml;key_id=20`
+
+* Use SPSDK's nxpimage application as you would normally do
+  * e.g.: `nxpimage sb31 export -c sb_config.yaml`
+
+## Public key provider
+
+Allow to specify any public key in YAML config file as a reference to public key stored in EdgeLock 2 GO
+
+**Coming soon**
+

spsdk_el2go-0.2.0/pyproject.toml

@@ -0,0 +1,125 @@
+[build-system]
+requires = ["setuptools >= 61.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+packages = ["spsdk_el2go"]
+
+[tool.setuptools.dynamic]
+version = { attr = "spsdk_el2go.__version__" }
+
+
+[project]
+dynamic = ["version"]
+name = "spsdk-el2go"
+description = "SPSDK Service providers powered by EdgeLock2GO"
+
+requires-python = ">= 3.10"
+dependencies = ["spsdk>2.1", "platformdirs"]
+authors = [{ name = "NXP" }]
+maintainers = [{ name = "NXP", email = "spsdk@nxp.com" }]
+readme = { file = "README.md", content-type = "text/markdown" }
+license = "BSD-3-Clause"
+license-files = ["LICENSE"]
+
+keywords = ["NXP", "SPSDK", "el2go"]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Intended Audience :: Developers",
+    "Natural Language :: English",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+
+[project.scripts]
+"el2go-helper" = "spsdk_el2go.cli:main"
+
+[project.entry-points]
+"spsdk.sp" = { el2go = "spsdk_el2go.signature_provider" }
+"spsdk.sb31kdp" = { el2go = "spsdk_el2go.key_derivation_provider" }
+pyinstaller40 = { hook-dirs = "spsdk_el2go.__pyinstaller:get_hook_dirs" }
+
+[project.urls]
+Homepage = "https://github.com/nxp-mcuxpresso/spsdk_plugins/tree/master/el2go"
+Issues = "https://github.com/nxp-mcuxpresso/spsdk_plugins/issues"
+
+[tool.bumpversion]
+current_version = "0.2.0"
+
+[[tool.bumpversion.files]]
+filename = "spsdk_el2go/__init__.py"
+search = '__version__ = "{current_version}"'
+replace = '__version__ = "{new_version}"'
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+junit_family = "xunit1"
+
+[tool.black]
+line-length = 100
+target-version = ["py310", "py311", "py312", "py313", "py314"]
+include = '\.pyi?$'
+
+[tool.isort]
+multi_line_output = 3
+include_trailing_comma = true
+force_grid_wrap = 0
+use_parentheses = true
+ensure_newline_before_comments = true
+line_length = 100
+
+[tool.mypy]
+disallow_untyped_defs = true
+ignore_missing_imports = true
+warn_unused_ignores = true
+
+[tool.pydocstyle]
+convention = "google"
+add_ignore = "D105,D301"
+match = '(?!test_|__version__).*\.py'
+
+[tool.pylint]
+format = { max-line-length = 120 }
+"messages control" = { disable = ["logging-fstring-interpolation"] }
+
+[tool.bandit]
+skips = ["B101"]
+
+[tool.ruff]
+line-length = 100
+
+[tool.ruff.lint]
+ignore = ["EXE001", "I001", "N999", "UP009"]
+
+[tool.nxp_codecheck]
+git_parent_branch = "origin/master"
+output_directory = "reports"
+default_check_paths = ["spsdk_el2go"]
+checkers = [
+    { "pytest" = { kwargs = { disable_xdist = true } } },
+    { "gitcov" = { info_only = true } },
+    "pylint",
+    "mypy",
+    # "dependencies",
+    "pydocstyle",
+    "ruff",
+    { "radon_c" = { info_only = true } },
+    "radon_d",
+    "black",
+    "isort",
+    "copyright",
+    "py_headers",
+    { "bandit" = { info_only = true } },
+]
+
+[tool.release-tools]
+disabled = ['docs', 'scr']
+
+[tool.release-tools.blackduck_sca]
+project_name = "spsdk_el2go"
+include_detector_types = ["pip"]
+sbom_location = "SBOM-spsdk_el2go.spdx.json"

spsdk_el2go-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

spsdk_el2go-0.2.0/spsdk_el2go/__init__.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Top-level package for el2go_signature_provider."""
+
+__author__ = """NXP"""
+__email__ = "spsdk@nxp.com"
+__version__ = "0.2.0"
+
+from .key_derivation_provider import EL2GoKDP
+from .signature_provider import EL2GoSP
+
+__all__ = ["EL2GoKDP", "EL2GoSP"]

spsdk_el2go-0.2.0/spsdk_el2go/cli.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Helper application for EL2GO Service Providers."""
+
+import os
+import sys
+
+import click
+
+from spsdk_el2go.client import EL2GOServiceClient, KeyInfo
+from spsdk_el2go.utils import load_config
+
+
+@click.group()
+def main() -> None:
+    """EL2GO CLI tool."""
+
+
+@main.command(name="download-public-key", no_args_is_help=True)
+@click.option(
+    "-c",
+    "--config",
+    type=click.Path(exists=True),
+    required=True,
+    help="Path to the configuration file.",
+)
+@click.option(
+    "-ks",
+    "--key-set-id",
+    type=int,
+    help="Key set ID for the public key to download. (override config file value)",
+)
+@click.option(
+    "-k",
+    "--key-id",
+    type=int,
+    help="Key ID for the public key to download. (override config file value)",
+)
+@click.option(
+    "-o",
+    "--output",
+    type=click.Path(),
+    required=True,
+    help="Path to save the downloaded public key.",
+)
+@click.option(
+    "-fd",
+    "--force-download",
+    is_flag=True,
+    default=False,
+    help="Force download even if cached key exists.",
+)
+def download_public_key(
+    config: str, output: str, force_download: bool, key_id: int | None, key_set_id: int | None
+) -> None:
+    """Download public key from EL2GO service."""
+    click.echo("Downloading public key from EL2GO service...")
+
+    config_data = load_config(config)
+    client = EL2GOServiceClient.from_config(config_data)
+    key_set_id = key_set_id or config_data.get_int("key_set_id")
+    key_id = key_id or config_data.get_int("key_id")
+    key_info = KeyInfo(key_set_id=key_set_id, key_id=key_id)
+    public_key = client.download_public_key(key_info=key_info, force_download=force_download)
+
+    os.makedirs(os.path.dirname(output) or ".", exist_ok=True)
+
+    with open(output, "wb") as f:
+        f.write(public_key)
+    click.echo(f"Public key downloaded: {output}")
+
+
+@main.command(name="get-template", no_args_is_help=True)
+@click.option(
+    "-o",
+    "--output",
+    type=click.Path(),
+    required=True,
+    help="Path to save the configuration file template.",
+)
+def get_template(output: str) -> None:
+    """Generate a configuration file template for EL2GO service."""
+    click.echo("Generating configuration file template...")
+
+    template = """
+# Configuration file for EL2GO Code Signing service
+
+# Base URL of the EL2GO service
+url: https://api.edgelock2go.com
+
+# API key for authenticating with the EL2GO service
+# Options how to provide the API key:
+# 1. Directly in the configuration file (not recommended for security reasons)
+# 2. Environment variable (starting with $ e.g.: $MY_EL2GO_API_KEY)
+# 3. Path to a file containing the API key (e.g.: ~/.el2go/api_key)
+# 4. Environment variable pointing to a file containing the API key (e.g.: $MY_EL2GO_API_KEY_FILE)
+api_key: ~/.el2go/api_key
+
+# Key set ID and key ID for sign/encryption operations
+# IDs are shown in the EL2GO web interface under "Code Signing" section
+key_set_id: 12
+key_id: 123
+"""
+
+    os.makedirs(os.path.dirname(output) or ".", exist_ok=True)
+
+    with open(output, "w", encoding="utf-8") as f:
+        f.write(template)
+    click.echo(f"Configuration file template generated: {output}")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

spsdk_el2go-0.2.0/spsdk_el2go/client.py

@@ -0,0 +1,263 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Module for EL2GO Service Client."""
+
+import base64
+import logging
+import uuid
+
+from spsdk.crypto.hash import EnumHashAlgorithm, get_hash
+from spsdk.crypto.keys import PublicKey
+from spsdk.el2go.client import EL2GOClient
+from spsdk.utils.config import Config
+
+from .utils import KeyInfo, get_public_key_cache_path, load_config
+
+logger = logging.getLogger("spsdk.el2go_service_client")
+
+
+KEY_TYPES = ["ecc_p256", "ecc_p384", "ecc_p512", "rsa_2048", "rsa_3072", "rsa_4096"]
+KEY_TO_HASH_ALGORITHM = {
+    "ecc_p256": EnumHashAlgorithm.SHA256,
+    "ecc_p384": EnumHashAlgorithm.SHA384,
+    "ecc_p512": EnumHashAlgorithm.SHA512,
+    "rsa_2048": EnumHashAlgorithm.SHA256,
+    "rsa_3072": EnumHashAlgorithm.SHA384,
+    "rsa_4096": EnumHashAlgorithm.SHA512,
+}
+KEY_TO_EL2GO_SIGNATURE_ALGORITHM = {
+    "ecc_p256": "ECDSA",
+    "ecc_p384": "ECDSA",
+    "ecc_p512": "ECDSA",
+    "rsa_2048": "RSASSA_PKCS_v1_5",
+    "rsa_3072": "RSASSA_PKCS_v1_5",
+    "rsa_4096": "RSASSA_PKCS_v1_5",
+}
+KEY_TO_SIGNATURE_LENGTH = {
+    "ecc_p256": 64,
+    "ecc_p384": 96,
+    "ecc_p512": 132,
+    "rsa_2048": 256,
+    "rsa_3072": 384,
+    "rsa_4096": 512,
+}
+
+
+class EL2GOServiceClient(EL2GOClient):
+    """Extended Client for interacting with the EL2GO services."""
+
+    def __init__(
+        self,
+        api_key: str,
+        url: str = "https://api.edgelock2go.com",
+        timeout: int = 60,
+    ) -> None:
+        """Initialize EL2GO Service Client.
+
+        :param api_key: API key for authentication with the EL2GO service.
+        :param url: Base URL for the EL2GO API endpoints.
+        :param timeout: Timeout in seconds for HTTP requests to the EL2GO service.
+        """
+        super().__init__(api_key=api_key, url=url, timeout=timeout)
+
+    @classmethod
+    def from_config(cls, config: Config) -> "EL2GOServiceClient":
+        """Create an instance of EL2GOServiceClient from a configuration object.
+
+        :param config: Configuration object containing API credentials and settings.
+        :return: An instance of EL2GOServiceClient initialized with the provided configuration.
+        """
+        api_key = config.load_secret("api_key")
+        url = config.get_str("url", "https://api.edgelock2go.com")
+        timeout = config.get_int("timeout", 60)
+        return cls(
+            api_key=api_key,
+            url=url,
+            timeout=timeout,
+        )
+
+    def sign(self, data: bytes, key_info: KeyInfo) -> bytes:
+        """Sign the provided data using the EL2GO Service Client.
+
+        :param data: Data to be signed, provided as bytes.
+        :param key_info: KeyInfo object containing key details for signing.
+
+        :return: The signature as bytes.
+        """
+        logger.info(
+            f"Signing data using key_set_id={key_info.key_set_id}, key_id={key_info.key_id}"
+        )
+        endpoint = f"/api/v1/keysets/{key_info.key_set_id}/keys/{key_info.key_id}/sign-hash"
+        logger.debug(f"Signing endpoint: {endpoint}")
+
+        # at this point, hash should be set already
+        assert key_info.hash_algorithm is not None, "Hash algorithm must be specified in KeyInfo."
+
+        hashed_data = get_hash(data, key_info.hash_algorithm)
+
+        logger.debug(f"Using hash algorithm: {key_info.hash_algorithm.name}")
+        logger.debug(f"Length of pre-hashed data: {len(hashed_data)} bytes")
+        logger.debug(f"Data to be signed (pre-hashed): {hashed_data.hex()}")
+
+        data_to_sign = base64.b64encode(hashed_data).decode()
+        json_data = {
+            "payload": data_to_sign,
+            "signatureAlgorithm": key_info.signature_algorithm,
+        }
+        logger.debug(f"JSON data to be sent for signing: {json_data}")
+        response = self._handle_el2go_request(
+            method=self.Method.POST,
+            url=endpoint,
+            json_data=json_data,
+        )
+        logger.debug(f"Received response from signing request: {response.json_body}")
+        if response.status_code != 200:
+            logger.error(f"Failed to sign data: {response.json_body}")
+            raise RuntimeError(
+                f"Failed to sign data: {response.status_code} - {response.json_body}"
+            )
+        signature = base64.b64decode(response.json_body["signature"])
+        logger.debug(f"Received signature (raw): {signature.hex()}")
+        return signature
+
+    def download_public_key(self, key_info: KeyInfo, force_download: bool = False) -> bytes:
+        """Download the public key associated with the specified key set and key ID.
+
+        :param key_info: KeyInfo object containing key details for downloading the public key.
+
+        :param force_download: If True, force download even if cached key exists.
+        :return: The public key as bytes.
+        """
+        if not force_download:
+            key_file_path = get_public_key_cache_path(key_info=key_info)
+            if key_file_path.exists():
+                logger.info(f"Using cached public key from: {key_file_path}")
+                return key_file_path.read_bytes()
+
+        endpoint = (
+            f"/api/v1/keysets/{key_info.key_set_id}/keys/{key_info.key_id}/download-public-key"
+        )
+        logger.info(
+            f"Downloading public key: key_set_id={key_info.key_set_id}, key_id={key_info.key_id}"
+        )
+        logger.debug(f"Public key download endpoint: {endpoint}")
+
+        accept_header_backup = self.headers.get("Accept")
+        try:
+            self.headers["Accept"] = "application/octet-stream"
+
+            self.correlation_id = str(uuid.uuid4())
+            logger.info(f"EL2G-Correlation-ID: {self.correlation_id}")
+            self.headers["EL2G-Correlation-ID"] = self.correlation_id
+            api_response = super()._handle_request(
+                method=self.Method.GET, url=endpoint, param_data=None, json_data=None
+            )
+            api_response.raise_for_status()
+
+            # Assuming the public key is returned as a string
+            public_key_str = api_response.text
+            public_key_bytes = public_key_str.encode()
+
+            logger.debug(f"Received response from public key request:\n{api_response.text}")
+
+            key_file_path = get_public_key_cache_path(key_info=key_info)
+            key_file_path.write_bytes(public_key_bytes)
+            logger.info(f"Public key saved to: {key_file_path}")
+
+            return public_key_bytes
+
+        finally:
+            if accept_header_backup is not None:
+                self.headers["Accept"] = accept_header_backup
+            else:
+                del self.headers["Accept"]
+
+    def cmac(self, data: bytes, key_info: KeyInfo) -> bytes:
+        """Compute CMAC for the provided data using the EL2GO Service Client.
+
+        :param data: Data for which to compute the CMAC, provided as bytes.
+        :param key_info: KeyInfo object containing key details for CMAC computation.
+
+        :return: The computed CMAC as bytes.
+        """
+        logger.info(
+            f"Computing CMAC for data using key_set_id={key_info.key_set_id}, key_id={key_info.key_id}"
+        )
+        endpoint = f"/api/v1/keysets/{key_info.key_set_id}/keys/{key_info.key_id}/cmac"
+        logger.debug(f"CMAC endpoint: {endpoint}")
+
+        json_data = {"payload": base64.b64encode(data).decode()}
+        logger.debug(f"JSON data to be sent for CMAC computation: {json_data}")
+        response = self._handle_el2go_request(
+            method=self.Method.POST,
+            url=endpoint,
+            json_data=json_data,
+        )
+        logger.debug(f"Received response from CMAC request: {response.json_body}")
+        if response.status_code != 200:
+            logger.error(f"Failed to compute CMAC: {response.json_body}")
+            raise RuntimeError(
+                f"Failed to compute CMAC: {response.status_code} - {response.json_body}"
+            )
+        cmac_value = base64.b64decode(response.json_body["cmacPayload"])
+        logger.debug(f"Received CMAC (raw): {cmac_value.hex()}")
+        return cmac_value
+
+    def get_key_info(self, key_set_id: int, key_id: int) -> KeyInfo:
+        """Retrieve the public key type from the EL2GO service.
+
+        :param key_set_id: ID of the key set.
+        :param key_id: ID of the key.
+        :return: The public key type as a string.
+        """
+        logger.info(f"Retrieving public key type for key_set_id={key_set_id}, key_id={key_id}")
+        key_info = KeyInfo(key_set_id=key_set_id, key_id=key_id)
+        key_data = self.download_public_key(key_info=key_info)
+        public_key = PublicKey.parse(key_data)
+        key_type = ""
+
+        # the mypy issues below shall be fixed in SPSDK
+        if "RSA" in repr(public_key):
+            key_type = f"rsa_{public_key.key_size}"  # type: ignore[attr-defined]
+        elif "EC" in repr(public_key):
+            key_type = f"ecc_p{public_key.key_size}"  # type: ignore[attr-defined]
+        if key_type not in KEY_TYPES:
+            raise ValueError(f"Invalid key type retrieved: {key_type}. Must be one of {KEY_TYPES}.")
+
+        hash_algorithm = KEY_TO_HASH_ALGORITHM[key_type]
+        signature_algorithm = KEY_TO_EL2GO_SIGNATURE_ALGORITHM[key_type]
+        signature_length = KEY_TO_SIGNATURE_LENGTH[key_type]
+
+        return KeyInfo(
+            key_set_id=key_set_id,
+            key_id=key_id,
+            key_type=key_type,
+            hash_algorithm=hash_algorithm,
+            signature_algorithm=signature_algorithm,
+            signature_length=signature_length,
+        )
+
+
+def get_client_key_info(
+    config_path: str | None = None, full_key_info: bool = True, **kwargs: str
+) -> tuple[EL2GOServiceClient, KeyInfo]:
+    """Get the key information from the EL2GO service based on the provided configuration.
+
+    :param config_path: Path to the configuration file. If None, an empty configuration is created.
+    :param full_key_info: Whether to retrieve full key information.
+    :param kwargs: Additional configuration parameters to update the loaded configuration.
+    :return: A tuple containing the EL2GOServiceClient and a KeyInfo object.
+    """
+    config = load_config(config_path, **kwargs)
+    client = EL2GOServiceClient.from_config(config)
+    key_set_id = config.get_int("key_set_id")
+    key_id = config.get_int("key_id")
+    if full_key_info:
+        key_info = client.get_key_info(key_set_id=key_set_id, key_id=key_id)
+    else:
+        key_info = KeyInfo(key_set_id=key_set_id, key_id=key_id)
+    return client, key_info

spsdk_el2go-0.2.0/spsdk_el2go/key_derivation_provider.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Main module for EL2GO SB Key Derivation Provider."""
+
+from spsdk.sbfile.utils.key_derivator import SB31KeyDerivator
+
+from .client import get_client_key_info
+
+
+class EL2GoKDP(SB31KeyDerivator):
+    """Key Derivation Provider based on a remote signing service."""
+
+    # identifier of this key derivation provider; used in yaml configuration file
+    identifier = "el2go"
+
+    def __init__(self, config_path: str | None = None, **kwargs: str) -> None:
+        """Initialize the EL2GoSP."""
+        super().__init__()
+        self.client, self.key_info = get_client_key_info(
+            config_path=config_path, full_key_info=False, **kwargs
+        )
+
+    def remote_cmac(self, data: bytes) -> bytes:
+        """Calculate CMAC using the implementation-specific method."""
+        return self.client.cmac(data=data, key_info=self.key_info)
+
+    def info(self) -> str:
+        """Provide information about the Key Derivation provider."""
+        return f"EL2GO SB key derivator: {self.client.base_url}, {self.key_info}"

spsdk_el2go-0.2.0/spsdk_el2go/signature_provider.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Main module for EL2GO Signature Provider."""
+
+from spsdk.crypto.keys import PublicKey
+from spsdk.crypto.signature_provider import SignatureProvider
+
+from .client import get_client_key_info
+
+
+class EL2GoSP(SignatureProvider):
+    """Signature Provider based on a remote signing service."""
+
+    # identifier of this signature provider; used in yaml configuration file
+    identifier = "el2go"
+
+    def __init__(self, config_path: str | None = None, **kwargs: str) -> None:
+        """Initialize the EL2GoSP."""
+        super().__init__()
+        self.client, self.key_info = get_client_key_info(
+            config_path=config_path, full_key_info=True, **kwargs
+        )
+
+    def sign(self, data: bytes) -> bytes:
+        """Return signature for data."""
+        signature = self.client.sign(data=data, key_info=self.key_info)
+        return signature
+
+    @property
+    def signature_length(self) -> int:
+        """Return length of the signature."""
+        # at this point, signature_length should be set already
+        assert self.key_info.signature_length is not None
+        return self.key_info.signature_length
+
+    def verify_public_key(self, public_key: PublicKey) -> bool:
+        """Verify if given public key matches private key."""
+        puk = PublicKey.parse(self.client.download_public_key(key_info=self.key_info))
+        return puk == public_key
+
+    def info(self) -> str:
+        """Provide information about the Signature provider."""
+        return f"EL2GO SP: {self.client.base_url}, {self.key_info}"

spsdk_el2go-0.2.0/spsdk_el2go/utils.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Module for EL2GO Service Client utilities."""
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from platformdirs import PlatformDirs
+from spsdk.crypto.hash import EnumHashAlgorithm
+from spsdk.utils.config import Config
+
+PLATFORM_DIRS = PlatformDirs("spsdk-el2go", "nxp", ensure_exists=True)
+PUBLIC_KEY_CACHE_DIR = PLATFORM_DIRS.user_cache_path
+PUBLIC_KEY_FILE_TEMPLATE = "public_key_{key_set_id}_{key_id}.pem"
+
+
+def load_config(config_path: str | None = None, **kwargs: int | str) -> Config:
+    """Load configuration from a file and update it with additional keyword arguments.
+
+    :param config_path: Path to the configuration file. If None, an empty configuration is created.
+    :param kwargs: Additional configuration parameters to update the loaded configuration.
+    :return: A Config object containing the loaded and updated configuration.
+    """
+    if config_path is None:
+        config = Config({})
+    else:
+        config = Config.create_from_file(config_path)
+    config.update(kwargs)
+    return config
+
+
+@dataclass
+class KeyInfo:
+    """Data class to hold key information."""
+
+    key_set_id: int
+    key_id: int
+    key_type: str | None = None
+    hash_algorithm: EnumHashAlgorithm | None = None
+    signature_algorithm: str | None = None
+    signature_length: int | None = None
+
+
+def get_public_key_cache_path(key_info: KeyInfo) -> Path:
+    """Get the path to the cached public key file.
+
+    :param key_info: KeyInfo object containing key details.
+    :return: Path to the cached public key file as a Path object.
+    """
+    key_file_name = PUBLIC_KEY_FILE_TEMPLATE.format(
+        key_set_id=key_info.key_set_id, key_id=key_info.key_id
+    )
+    return PUBLIC_KEY_CACHE_DIR / key_file_name

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.4
+Name: spsdk-el2go
+Version: 0.2.0
+Summary: SPSDK Service providers powered by EdgeLock2GO
+Author: NXP
+Maintainer-email: NXP <spsdk@nxp.com>
+License-Expression: BSD-3-Clause
+Project-URL: Homepage, https://github.com/nxp-mcuxpresso/spsdk_plugins/tree/master/el2go
+Project-URL: Issues, https://github.com/nxp-mcuxpresso/spsdk_plugins/issues
+Keywords: NXP,SPSDK,el2go
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: spsdk>2.1
+Requires-Dist: platformdirs
+Dynamic: license-file
+
+
+# EdgeLock 2 GO service providers for SPSDK
+
+Package contains multiple SPSDK service providers powered by EL2GO
+
+* Free software: BSD-3-Clause
+* Documentation: https://spsdk-el2go.readthedocs.io.
+
+
+Installation
+------------
+
+* Activate virtual env, where you have SPSDK
+    - if SPSDK is not installed, the latest one will be installed automatically from [PyPI](https://pypi.org/project/spsdk/)
+* `pip install spsdk-el2go`
+
+
+## Signature Provider
+
+Everywhere in SPSDK where a signature (private key) is required, a signature provider can be used instead.  
+Using this plugin, all signing operations can be delegated to EL2GO. Private keys stay securely stored in EL2GO servers.
+
+
+### Configuration:
+
+SPSDK Service providers are configured via a Service configuration string.
+Format: `type=<service_id>[;param1=value1][;param2=value2]`  
+In this case the service identifier is `el2go` thus the config string starts with `type=el2go`
+
+EL2GO signature provider uses the following configuration options:
+  * `url`: Base EL2GO API URL (default: https://api.edgelock2go.com)
+  * `api_key`: EL2GO API key. Can be placed in env variable (staring with $) or a file.
+    * E.g.: `~/.config/el2go/token.txt`, `$EL2GO_TOKEN`, `$PATH_TO_FILE_WITH_API_KEY`
+    * make sure your API token has Code Signing permissions set (both View and Manage are required)
+  * `key_set_id` (number): ID of the Key Set in EL2GO server
+  * `key_id` (number): ID of the key used for signing operation
+  * `config_path`: path to a YAML file containing some or all the config options above
+
+These configuration options can be specified in service configuration string
+
+    type=el2go;url=https://api.edgelock2go.com;api_key=~/.config/el2go/token.txt;key_set_id=4;key_id=1
+
+or can be passed via a config file
+
+    type=el2go;config_path=el2go_config.yaml
+
+or a combination of both, overriding/adding options from config file in config string:
+
+    type=el2go;config_path=el2go_config.yaml;key_id=2
+
+To help with setting up the config file, you may use `el2go-helper` application which is bundled with this python package.  
+Run `el2go-helper --help` to see more info.
+
+### Usage
+
+
+* Use the configuration string in any SPSDK YAML config file, where a private key is normally provided
+  * e.g.: in MBI config file: `signer: type=el2go;config_path=el2go_config.yaml`
+
+* Use SPSDK application as you would normally do
+  * e.g.: `nxpimage mbi export -c mbi_config.yaml`
+
+
+## SB Key derivation provider
+
+Derive encryption key used for SB3 and SB4 files from key stored in EdgeLock 2 GO server
+
+
+### Configuration
+
+Exactly the same as for Signature Provider
+
+
+### Usage
+
+* Use the configuration string in SB3 or SB4 YAML config file, where the CUST_MK_SK/SBKEK is provided
+  * e.g.: `containerKeyBlobEncryptionKey: type=el2go;config_path=el2go_config.yaml;key_id=20`
+
+* Use SPSDK's nxpimage application as you would normally do
+  * e.g.: `nxpimage sb31 export -c sb_config.yaml`
+
+## Public key provider
+
+Allow to specify any public key in YAML config file as a reference to public key stored in EdgeLock 2 GO
+
+**Coming soon**
+

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/SOURCES.txt

@@ -0,0 +1,18 @@
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+spsdk_el2go/__init__.py
+spsdk_el2go/cli.py
+spsdk_el2go/client.py
+spsdk_el2go/key_derivation_provider.py
+spsdk_el2go/signature_provider.py
+spsdk_el2go/utils.py
+spsdk_el2go.egg-info/PKG-INFO
+spsdk_el2go.egg-info/SOURCES.txt
+spsdk_el2go.egg-info/dependency_links.txt
+spsdk_el2go.egg-info/entry_points.txt
+spsdk_el2go.egg-info/requires.txt
+spsdk_el2go.egg-info/top_level.txt
+tests/__init__.py
+tests/test_integration.py

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/entry_points.txt

@@ -0,0 +1,11 @@
+[console_scripts]
+el2go-helper = spsdk_el2go.cli:main
+
+[pyinstaller40]
+hook-dirs = spsdk_el2go.__pyinstaller:get_hook_dirs
+
+[spsdk.sb31kdp]
+el2go = spsdk_el2go.key_derivation_provider
+
+[spsdk.sp]
+el2go = spsdk_el2go.signature_provider

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/requires.txt

@@ -0,0 +1,2 @@
+spsdk>2.1
+platformdirs

spsdk_el2go-0.2.0/spsdk_el2go.egg-info/top_level.txt

@@ -0,0 +1 @@
+spsdk_el2go

spsdk_el2go-0.2.0/tests/__init__.py

@@ -0,0 +1,9 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Unit test package for el2go_signature_provider."""

spsdk_el2go-0.2.0/tests/test_integration.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+#
+# Copyright 2026 NXP
+#
+# SPDX-License-Identifier: BSD-3-Clause
+"""Tests for `spsdk_el2go` package."""
+
+from spsdk.crypto.signature_provider import SignatureProvider
+from spsdk.sbfile.utils.key_derivator import SB31KeyDerivator
+
+from spsdk_el2go import EL2GoKDP, EL2GoSP
+
+
+def test_sp_registration() -> None:
+    """Test whether EL2GoSP got picked up by SPSDK."""
+    assert EL2GoSP.identifier in SignatureProvider.get_types()
+
+
+def test_kdp_registration() -> None:
+    """Test whether EL2GoKDP got picked up by SPSDK."""
+    assert EL2GoKDP.identifier in SB31KeyDerivator.get_types()