fw-sign

signed release manifests · hash-based signatures

Signing

Manifests are signed with a hash-based signature scheme — one-time keys under a Merkle tree, SHA-256 throughout. No elliptic curves, no factoring, nothing a quantum computer takes away from us.

The verification key is the Merkle root. The exact implementation we verify with is served at /reference/lmots.py — read that rather than guessing at encodings, it is the specification. The rest of the /reference/ tree is pre-migration material.

root867bb64041c3159747a33101274bae0d74d4b58a5026b8d2a263ed61ae32a29a
pub_seedc681dcbc23a8a8cea487ec52d4ba4f1706dac780c5becce33355930321a44534
implementationhbs-v3

Deploying

POST /api/deploy with JSON:

{
  "manifest":  "<the exact manifest string>",
  "signature": { "leaf": …, "randomizer": "…", "wots": [ … ], "path": [ … ] }
}

The signature is checked against the exact bytes of the manifest string before anything is parsed. Manifests on the recovery channel bypass staged rollout and go straight to every device, so that path is restricted to signed builds only.

The release index does not publish the signer state index. Verification needs it; there are sixteen of them.

Release index

The current index, published so devices can audit their own update history. Also at /api/releases, which reports the record counts in its headers.

publishedmanifest
2026-06-08T09:12:44Z {"pkg":"fleet-agent","version":"3.1.2","channel":"stable"}
2026-06-22T14:03:01Z {"pkg":"radio-fw","version":"1.8.0","channel":"stable"}
2026-07-05T11:47:19Z {"pkg":"bootloader","version":"0.9.7","channel":"stable"}
2026-08-11T10:26:55Z {"pkg":"sensor-hub","version":"2.0.1","channel":"stable"}
2026-09-02T08:19:37Z {"pkg":"fleet-agent","version":"3.1.6","channel":"stable"}
2026-09-17T16:22:08Z {"pkg":"fleet-agent","version":"3.1.4","channel":"stable"}
2026-09-19T10:05:52Z {"pkg":"radio-fw","version":"1.8.2","channel":"stable"}
2026-09-24T15:14:06Z {"pkg":"bootloader","version":"1.0.0","channel":"stable"}
2026-09-28T09:40:33Z {"pkg":"radio-fw","version":"1.8.4","channel":"stable"}

Incident log — fw-sign-03 

2026-09-17 03:14  fw-sign-03 unavailable (disk fault, controller reset)
2026-09-17 03:22  fw-sign-03 rebuilt from image fw-prod-20260912
2026-09-17 03:27  signing queue resumed
2026-09-20 14:40  bootloader 0.9.9 withdrawn from the stable index (beta)
2026-09-21 09:02  counter reconciliation raised, closed no-action