`sign-data` command requires `key` argument in `--hsm` mode (ESPTOOL-1185)

[ulrichb]

Operating System

Ubuntu

Esptool Version

5.1.0

Python Version

Python 3

Full Esptool Command Line that Was Run

espsecure sign-data --version 2 --hsm --hsm-config "hsm_config.ini" ...

Esptool Output

Missing option '--keyfile' / '-k'.

What is the Expected Behaviour?

Don't require a --keyfile parameter (currently I'm providing a dummy file) when using the --hsm command line (as documented).

(And I'm not talking about the --pub-key parameter.)

More Information

No response

Other Steps to Reproduce

No response

[github-actions]

Hi @ulrichb! Please be aware that (1) the following suggestions are generated by a bot and haven't been fact-checked by Espressif Systems, (2) burning eFuses and enabling security features are irreversible operations and can damage your ESP32 device. We hope that this message will help you until an Espressif Engineer looks at your issue.

---

Thank you for reporting this issue.

According to the official Espressif documentation, when using the espsecure sign-data --version 2 --hsm --hsm-config <hsm_config_file> ... command, the --keyfile (or --pub-key) parameter should not be required if the public key is stored in the HSM. The documentation states:

The above command first extracts the public key from the HSM, generates a signature for an image using the HSM, and then creates a signature block and appends it to the image to generate a signed image.

If the public key is not stored in the external HSM, you can specify the --pub-key argument to supply the public key.

This means that, as per the documentation, you should not need to provide a --keyfile (or dummy file) when the public key is available in the HSM and the --hsm mode is used. The tool is expected to extract the public key directly from the HSM in this scenario. If espsecure is requiring a --keyfile in this case, it is not behaving as documented and this appears to be a bug or a regression in the tool.

References:

• espsecure documentation: Remote Signing Using an External HSM

Suggested Action:
This behavior is inconsistent with the documentation. Please consider this a valid issue, and it may require a fix in a future release of esptool.

If you need a workaround in the meantime, providing a dummy --keyfile as you have done is a temporary solution, but it should not be necessary according to the official documentation.

Let me know if you need further clarification or assistance!

[dobairoland]

@ulrichb Could you please try the latest master version? I think this might have already been fixed by ee35dda which is not yet released.

[ulrichb]

Oh just 3 days ago :)

Yes, according to the code this is exactly what this ticket is about.

Sorry for the dumb question, but I don't know how to test a master version (I just did pip install 'esptool[hsm]').

But nevermind, I'm very sure that the commit you referenced will fix my issue. So many thanks!

[dobairoland]

Sorry for the dumb question, but I don't know how to test a master version (I just did pip install 'esptool[hsm]').

You can clone the repository and from it run pip install ".[hsm]".

Anyway, thanks for your reply. I'm closing this under the assumption that this has already been fixed.