1. The goal
Unsigned firmware on the OTA path is an open door. The signing pipeline measures integrity and applies a cryptographic signature to every byte of the image before it leaves the build system, then registers the hash, the version, and the security counter on the SimtoLink Device Management Platform. A batch OTA job can cite only an artifact that is registered.
The pipeline is also the chain of responsibility: who started the build, who approved the signature, and which ticket matches which release. When a bad version shows up in the field, the team can find the source in minutes, instead of hunting through shared drives and chat history.
2. What each stage does
Signing from CI
When the build produces the binary, it calls the HSM signing API. CI holds only a rate-limited credential. The signing key never leaves the module, so nobody signs a file on a laptop and uploads it.
Keys per environment
Test, staging, and production keys stay apart, in step with credential rotation. The device keeps the old public key through a transition window, so old and new firmware can change over without a break.
An audit trail
Each signature records the operator, the pipeline ID, the Git commit, and the SBOM hash. After an incident you can name the affected batch, which is what a compliance audit asks for.
3. The path of a build
4. What the platform records
| Capability | What it does |
|---|---|
| CI | A webhook starts the pipeline. Jenkins, GitLab CI, and GitHub Actions are supported |
| HSM signature | A cloud HSM or a local HSM. RSA and ECDSA. The key is managed for its whole life |
| Hash registration | The artifact hash, the security version, and the compatible hardware revision go into the platform. OTA can cite only a registered artifact |
| Release gate | A person approves, or a rule does. The registry is split by environment: dev, staging, and prod |
5. The stages, in order
CI produces the binary, then a static scan and an SBOM, then the HSM signing API, then the encrypted artifact goes to object storage, then a webhook tells the platform to register the metadata, then a person or a rule opens the gate. A failure at any stage stops the chain, so a half-finished build does not leak out.
6. The keys
The signing key never leaves the HSM. CI holds only a rate-limited API credential. Test, pre-production, and production keys stay apart. This lines up with credential rotation, and the device keeps the old public key through the transition.
7. Lined up with the device trust chain
The registration has to include the security version and the compatible hardware revision, so the device can check them on the secure boot chain. If differential updates are on, the patch is signed and registered on its own.
8. Audit
Each signature records the operator, the pipeline ID, the Git commit, and the SBOM hash, for the compliance audit. After an incident, the affected batch can be named quickly.
9. What not to do
Do not sign on a developer laptop and upload the file. Do not share a test key with production. Do not skip the SBOM. That is how supply-chain visibility disappears.
Another failure is a pipeline that signs without a gate: any merge can produce a signature, so poisoning the repository is enough to get a legitimately signed package. Protect the main branch and require review, and put the signing step behind a controlled runner and the HSM.
10. Closed with OTA
After registration, a job is queued only when the artifactId it cites matches the signature record. Registries are split by environment: dev, staging, and prod. A package that conflicts with the secure boot chain is refused, with an error a person can read, so a mistaken push is faster to diagnose.
11. What to measure
Count signatures per week, average approval time, why a registration was refused, and the error rate on the key API. A jump can mean a credential is about to expire, or the HSM is short of capacity. Expand and rotate the credential before that happens.
12. Summary
The firmware signing pipeline joins secure development to trust in the field. The SimtoLink Device Management Platform is the release hub, so only an artifact that came through the pipeline reaches ten million devices. Further reading: version management and regulatory mapping.
Appendix. A signing line that stays trustworthy
A signing pipeline that works in a lab still needs three habits before it feeds a fleet. On a pre-release batch built like production, rehearse a connection storm, a full disk, certificate rotation, and a fault across regions, and keep the notes as an acceptance checklist. Put signature volume, gate latency, the on-call path, and audit retention into change management, so a key or a gate rule can be traced and rolled back without depending on one release engineer. Each quarter, engineering, operations, security, and data should ask whether those figures still explain the risk, and attach the actions to tickets and the release calendar. The console, open API, and export on the SimtoLink Device Management Platform stay in service: observable, orchestrable, and auditable. If the pipeline has to meet your ITSM, IAM, data lake, or edge cluster, the SimtoLink solutions team can review the architecture with you and return an implementation note and a risk list.