伙伴openubmc版本如何支持升级华为签名固件版本和伙伴自己签名的固件版本均能成功？

Security SIG
1

1.我在华为官网下载了 Huawei Integrity Root CA - G2.der这个证书后重命名为rootca.der放在manifest目录的build/product/BMC/openUBMC/rootfs/opt/bmc/trust/partner目录；
2. 执行bingo build -b openUBMC出包；
3. web升级该openUBMC版本后，再升级从华为官网发布的cpld版本和bios版本，均提示无效的升级包？
初步定位过程：

  1. 查看bmc后台/opt/bmc/trust/partner/目录下确实存在rootca.der文件，经过对比与 Huawei Integrity Root CA - G2.der完全一样；
  2. 查看日志发现提示verify signature error,code 88200004
    请问下该问题要怎样解决？
    证书&华为cpld固件.zip (195.6 KB)
    dump_info.zip (3.1 MB)
2506高可用版本升级过渡包失败问题求助
CPLD hpm包签名后在web上升级时提示升级失败
伙伴签名openubmc版本是否支持同时升级华为签名固件版本和伙伴自己签名的固件版本？
固件签名问题
社区bingo无签名版本升级高可用版本签名疑问
25.09签名出包bingo编译问题
组件之内bingo build失败
2

只放置rootca.der证书不行，主要是需要修改firmware_mgmt组件下面的validate_sign.lua文件，增加验签过程。这个组件是没有开放出来的，目前只能场内制作。

3

你好，你那边验证过这样是可行的了吗？

4

猜测原因：
历史上支持pkcs v1.5和pss填充模式证书签名，你获取的固件可能使用pkcs v1.5填充模式的证书签名，Huawei Integrity Root CA - G2.der是PSS填充模式的证书，无法验签pkcs v1.5的固件。
检查方法：使用文档编辑器打开待升级hpm包，检查前15行左右是否存在”Huawei Integrity Root CA - G2“文字，如果没有就是PKCS V1.5的固件。
建议：对固件重签名。

4 个赞
bmcgo 升级签名校验与预期不一致——请协助确认归属层级，并指引代码位置与调试方法
升级完过渡包后，正式包升级失败
回复：伙伴openubmc版本如何支持升级华为签名固件版本和伙伴自己签名的固件版本均能成功？
5

海军哥厉害，参考这个，确实吧校验过了

6

您好，徐工：

目前华为这边提供给我的过度包里面，有上面写的Huawei Integrity Root CA信息：

image

我自己生成的签名固件，没有这个信息：

image

目前，我机器升级华为提供的过度包升级可以成功，但升级我们自己生成的签名固件，不成功。
是需要华为重新给我生成过度包还是我们这边修改什么配置，就可以升级了？

这个是一键收集的app.log里面的信息：

2025-12-01 12:32:48.876465 firmware_mgmt NOTICE: active_fructl.lua(95): get host type is Singlehost
2025-12-01 12:32:48.877041 firmware_mgmt NOTICE: utils.lua(36): The file path is Local.
2025-12-01 12:32:48.879498 firmware_mgmt NOTICE: init.lua(79): Upgrading_Flag is true
2025-12-01 12:32:48.894937 firmware_mgmt NOTICE: init.lua(40): update status to FS_SIMPLE_UPGRADING.
2025-12-01 12:32:48.912183 firmware_mgmt NOTICE: task_mgmt.lua(312): Create task[Id: 284213966, StartTime: 2025-12-01T12:32:48+08:00, Progress: 0, State: New] successfully
2025-12-01 12:32:48.912677 firmware_mgmt NOTICE: task_service.lua(55): task create success, task id: 284213966
2025-12-01 12:32:48.913708 firmware_mgmt NOTICE: task_id_mgmt.lua(30): add serial task id(284213966) successfully
2025-12-01 12:32:48.916128 firmware_mgmt NOTICE: tasks_scheduling.lua(121): start tasks processer
2025-12-01 12:32:49.016192 firmware_mgmt NOTICE: task_mgmt.lua(443): Update task[Id: 284213966, StartTime: 2025-12-01T12:32:48+08:00, Progress: 0, State: Running] successfully
2025-12-01 12:32:49.016966 firmware_mgmt NOTICE: file_transfer.lua(139): start to move file [rootfs_openUBMC.hpm] from tmp to shm
2025-12-01 12:32:50.987402 firmware_mgmt NOTICE: file_transfer.lua(144): move_file_s ok:true, err:0
2025-12-01 12:32:53.142228 firmware_mgmt NOTICE: validate_sign.lua(170): the custom ca certificate is exist, load custom certificate
2025-12-01 12:32:53.184030 firmware_mgmt NOTICE: validate_sign.lua(195): verify signature successfully
2025-12-01 12:32:53.185047 firmware_mgmt NOTICE: action.lua(37): Validate signature successfully
2025-12-01 12:32:53.186799 firmware_mgmt NOTICE: hpm_package.lua(762): ManufacturerValidateEnabled is false, there is no need to validate manufacture_id.
2025-12-01 12:32:53.225960 bmc_core ERROR: l_crypt.c(928): RSA_private_decrypt failed.
2025-12-01 12:32:53.226922 firmware_mgmt ERROR: hpm_package.lua(207): decrypt srcfile failed, err:./opt/bmc/apps/firmware_mgmt/lualib/upgrade/hpm_package.lua:188: rsa_decrypt failed
2025-12-01 12:32:53.227598 firmware_mgmt ERROR: action.lua(41): Unpack package failed
2025-12-01 12:32:53.228192 firmware_mgmt ERROR: task_instance.lua(159): parse package(rootfs_openUBMC.hpm) failed, ret:FirmwareUpgradeError.
2025-12-01 12:32:53.239983 web_backend NOTICE: base.lua(462): processing_flow_1 foreach_1 timeout,[path=/bmc/kepler/UpdateService, interface=bmc.kepler.UpdateService], t1=1764563569942, t2=1764563573239, time=3297
2025-12-01 12:32:53.246293 web_backend NOTICE: route_mapper.lua(301): uri:/UI/Rest/BMCSettings/UpdateService/UpdateProgress, method:get timeout, t1=1764563569936, t2=1764563573245, time=3309
2025-12-01 12:32:53.328818 firmware_mgmt NOTICE: task_mgmt.lua(174): task[Id: 284213966, StartTime: 2025-12-01T12:32:48+08:00, Progress: 0, State: Exception] will be destroyed after 10 minutes
2025-12-01 12:32:53.329832 firmware_mgmt NOTICE: task_mgmt.lua(443): Update task[Id: 284213966, StartTime: 2025-12-01T12:32:48+08:00, Progress: 0, State: Exception] successfully
2025-12-01 12:32:53.401429 firmware_mgmt ERROR: state_handle.lua(115): not find state obj
2025-12-01 12:32:54.469232 firmware_mgmt NOTICE: tasks_scheduling.lua(126): upgrade queue is empty, exit the tasks processer
2025-12-01 12:32:54.469840 firmware_mgmt NOTICE: tasks_scheduling.lua(138): stop tasks processer
2025-12-01 12:32:54.471705 firmware_mgmt NOTICE: active_fructl.lua(95): get host type is Singlehost
2025-12-01 12:32:54.472422 firmware_mgmt NOTICE: active_single_host_fructrl.lua(60): active_single_host_fructrl fructrl get power status
2025-12-01 12:32:54.478893 firmware_mgmt NOTICE: state_simple_upgrading.lua(101): simple upgraded, current active mode is:nil, wait restart seconds:360000
2025-12-01 12:32:54.490131 firmware_mgmt NOTICE: init.lua(40): update status to FS_IDLE.
2025-12-01 12:32:54.493472 firmware_mgmt NOTICE: init.lua(79): Upgrading_Flag is false
2025-12-01 12:33:06.227024 bmc_core ERROR: lldp_proc.c(318): Can’t find port name from LLDP
2025-12-01 12:33:08.464096 firmware_mgmt NOTICE: task_id_mgmt.lua(40): delete serial task id(284213966) successfully
2025-12-01 12:33:08.464498 firmware_mgmt NOTICE: task_id_mgmt.lua(42): del serial task id(284213966) successfully
2025-12-01 12:33:08.465102 firmware_mgmt NOTICE: task_instance.lua(100): destroy task info(id:284213966) successfully