search

gl-sergei / u2f-token

u2f token firmware for stm32f103 and efm32hg boards
GNU General Public License v3.0
339 stars 56 forks source link

Prebuilt binaries? #15

Closed ringerc closed 5 years ago

ringerc commented 5 years ago

Hi

Per my groups post at https://groups.google.com/d/msg/tomu-discuss/qk6oRofL8B0/ae0kj7mXEQAJ I think it'd be really helpful to have a prebuilt firmware binary available as a github "release" here.

That'd greatly lower the bar for basic experimentation and testing. It'd also help with QA - if someone has a problem you can ask them to try the latest prebuilt binary to help isolate build-env / toolchain issues.

I hope the suggestion is OK.

gl-sergei commented 5 years ago

It seems that travis might be able to upload the binary to github releases. I'll take a look at it.

assasinfil commented 5 years ago

In connection with the purchase of github by Microsoft, now travis does not collect releases. Not so difficult to do everything according to the instructions. Moreover, you need to generate a certificate yourself, for security purposes.

ringerc commented 5 years ago

Sure, it's hardly a showstopper, it'd just be really handy and help people try it out.

And yes, of course you'd generate your own certificate, but you'd be doing that whether you built from source or used binaries.

If you don't think it's useful/practical, sure, just close. It's a suggestion only.

gl-sergei commented 5 years ago

In connection with the purchase of github by Microsoft, now travis does not collect releases.

I don't think this is correct. At least Travis docs still describe how to upload to github releases.

Moreover, you need to generate a certificate yourself, for security purposes.

Actually, having your own attestation certificate is security concern. It allows websites to track you. I am not sure though, how important it is to keep the private key of the attestation certificate in secret. Worst thing I can think about is someone will create a device which will pretend to be running this firmware, but instead it will be running malicious firmware. But this issue currently is not addressed anyways.

gl-sergei commented 5 years ago

I will probably add a new build option allowing to upload your own attestation certificate and key via custom command and put together kind of admin tool which will allow to do that.

gl-sergei commented 5 years ago

First release is published on Github https://github.com/gl-sergei/u2f-token/releases/tag/v1.0. I'll update readme shortly.