boot-tool

Command-line utility for EriX boot.img files.

---

Implemented commands

• build: build a minimal boot image from a kernel ELF
• inspect: print structural metadata and section listing
• validate: parse and validate structure only
• verify: parse + cryptographic verification
• extract: extract a named section payload

---

Dependencies

• lib-bootimg (git dependency)
• lib-elf (git dependency)

No external crates are used.

---

Usage

# Build (kernel + optional early services and non-executable blobs)
boot-tool build \
  --kernel out/kernel.elf \
  --boot-config out/boot-config.bin \
  --early-service rootd:out/rootd.elf \
  --blob console-font:out/console-font.pf2 \
  --output out/boot.img \
  --key-id 0 \
  --build-id-input "ci:job-123"

# Validate structure
boot-tool validate --image out/boot.img

# Inspect image metadata
boot-tool inspect --image out/boot.img

# Verify image authenticity
boot-tool verify \
  --image out/boot.img \
  --pubkey-hex <64-hex-public-key> \
  --key-id 0

# Extract kernel section
boot-tool extract \
  --image out/boot.img \
  --section kernel \
  --output out/kernel.extracted

---

Build command options

• --kernel <path>: kernel ELF input (required)
• --output <path>: output image path (required)
• --early-service <name:path>: add required early boot service section (repeatable)
• --boot-config <path>: add required boot-config payload section (type=BootConfig)
• --blob <name:path>: add required non-executable blob section (repeatable)
• --key-id <u32>: signature key id (default 0)
• --build-id <hex64>: explicit 32-byte build id
• --build-id-input <string>: append UTF-8 build-id derivation input (repeatable)
• --signature-hex <hex128>: inject 64-byte Ed25519 signature
• --signing-payload-output <path>: write canonical signing payload

---

Verify command options

• --image <path>: boot image path (required)
• --pubkey-hex <hex64>: 32-byte Ed25519 public key (hex)
• --pubkey-file <path>: raw 32-byte Ed25519 public key file
• --key-id <u32>: expected signature key id (default 0)

Use either --pubkey-hex or --pubkey-file.

---

Notes

• Build flow always includes kernel and may include repeatable required early-boot-service sections via --early-service.
• --boot-config emits a boot-config section with SectionType::BootConfig and RequiredForBoot flag.
• Blob sections added via --blob are emitted as NonExecutableBlob + REQUIRED_FOR_BOOT entries, which is used for assets such as console-font.
• Manifest/TOML driven builds are planned but not implemented yet.