latest HaitiOS-0.6 very close

[James Cameron]

Yeah, I can see how you might think the .zip file is the same as the
.rom file, since they have the same version of firmware.

They are different packaging of the firmware.

The bootfw.zip contains within it a file data.img which was renamed
from q2f19.rom, and a file data.sig which is the cryptographic
signature for data.img.

The firmware opens bootfw.zip, reads the file data.sig, checks the
signature, and reads the file data.img, checks the version, and if
newer than current version begins a reflash.

The signature is critical to the normal firmware upgrade process.

Illustration:

$ wget [...]/bootfw.zip [...]/q2f19.rom
$ unzip bootfw.zip
$ md5sum q2f19.rom data.img data.sig
8ebeb4ada8d59c5031c48b60ecf0899b  q2f19.rom
8ebeb4ada8d59c5031c48b60ecf0899b  data.img
eea8805b8d965f4c8f93f8601d23c19c  data.sig
$ cmp q2f19.rom data.img && echo same
same
$ 

On Wed, Dec 18, 2013 at 07:39:06PM -0500, George Hunt wrote:
> I was checking the md5sum of bootfw.zip, as James suggested.  
> 
> I noticed that the q2f19.rom generated a different md5sum than the bootfw.zip.
> And I didn't think the filename was included in the md5sum.
> 
> So I copied the contents of the g2f19.4om to a file called bootfw.zip in the /
> boot folder on the USB stick.
> 
> The 4button startup no longer stalled.  So I suspect that Jerry's hunch was
> correct. To completely test the solution, I should downgrade the firmware, and
> make sure it gets upgraded.
> 
> Which I am about to do.
> 
> George
> 
> 
> On Wed, Dec 18, 2013 at 6:36 PM, James Cameron <quozl at laptop.org> wrote:
> 
>     On Wed, Dec 18, 2013 at 06:20:38PM -0500, George Hunt wrote:
>     > I'll test Jerry's hypothesis that the q2119 wasn't signed properly
>     > by substituting an official one. I'm out this evening. So whatever
>     > happens will need to be in the next 4 hours.
> 
>     We've never signed anything called q2119.
> 
>     Perhaps you mean q2f19.
> 
>     Check your copy is correct.
> 
>     q2f19's bootfw.zip has md5sum 8585307de5cc8d6867bf58ef56d59f3a
> 
>     To test that it is signed: downgrade a laptop to q2f18, put the file
>     on a USB drive in the boot directory, insert USB drive into laptop,
>     hold down the X game key, turn power on.  The display should say if
>     the signature passed or failed.
> 
>     The upstream link is
>     http://dev.laptop.org/pub/firmware/q2f19/bootfw.zip
>    
>     --
>     James Cameron
>     http://quozl.linux.org.au/
> 
> 

-- 
James Cameron
http://quozl.linux.org.au/