ListeningPost/open-firmware-manager

simple example of encrypted open firmware management using a PDS to sign firmware.

TypeScript

0 commits

updated Oct 5, 2026

See the code

See what people are saying

Newest first

Most points

Source	Message	Score	Date
	At-Protocol Based Encrypted Firmware Management Project	2	Oct 5, 2026
	Years ago I helped build one of the world's first generic firmware managers. The first of its kind to manage millions of devices by different manufacturers, rotating passwords, firmware, etc. over an unbounded number. Today we're open sourcing a prototype of the thing I always suspected could make… on At-Protocol Based Encrypted Firmware Management Project	0	Oct 5, 2026

README

Open Firmware

Production system for cryptographically signed software distribution over AT Protocol.

The distribution center is a PDS. Publishers write signed release chains (records + blobs). Edge agents and Sidekar pull, audit, and apply.

Products

Package	Role	Docker?
`@open-firmware/core`	Chunking, Phase A audit, service windows	No
`@open-firmware/atproto-lite`	Vanilla XRPC client	No
`@open-firmware/host`	Publish releases to PDS	No
`@open-firmware/client`	IoT/edge pull + verify + apply hooks	No
`@open-firmware/sidekar`	Server agent; optional Docker apply	Optional
`@open-firmware/iot`	Device identity, factory reset, sealed jobs	No
`@open-firmware/utility`	Admin: approve join, set password, jobs	No
`@open-firmware/server`	Private control plane API	No
`ofw` (Rust CLI)	`release` / `publish` / `pipeline-ack` / `audit`	No

Trust model

Author DID + PDS commit signatures authenticate records
Content digests (SHA-256) on release + chunks
Phase A validates the full chain before download
Phase B verifies blobs and full-image hash before apply

AppViews and dashboards are never the trust root.

Quick start (guided walkthrough)

cd examples/full-stack
./scripts/gen-pds-secrets.sh
docker compose up --build -d

# Guided UI (plain language + live status):
#   http://localhost:8099
# Full written tour:
#   examples/full-stack/WALKTHROUGH.md

./scripts/publish-to-pds.sh "Hello from Open Firmware"
# Workload: http://localhost:8080
# PDS:      http://127.0.0.1:2583/xrpc/_health

Production publish

cd cli && cargo install --path .

ofw publish \
  --pds https://your-pds.example \
  --identifier your-handle \
  --password "$OFW_PASSWORD" \
  --product my-app \
  --version 1.0.0 \
  --kind container \
  --file ./image.tar \
  --yes

GitHub Actions: cli/examples/github-actions-publish.yml.

IoT management (join / password / factory reset)

pnpm --filter @open-firmware/iot build
pnpm --filter @open-firmware/utility build
pnpm --filter @open-firmware/server build
pnpm --filter @open-firmware/iot-camera-emulator test:e2e

See examples/iot-camera-emulator and docs/private-plane.md.

Specs & docs

Develop

pnpm install
pnpm --filter @open-firmware/core test
pnpm --filter @open-firmware/iot test
pnpm -r run build
cd cli && cargo test && cargo build --release

License

Apache-2.0

Similar repos

project-oak/oak

Meaningful control of data in distributed systems.

1,510

ProofCore-Protocol/proofcore-action

GitHub Action for cryptographic release notarization & SLSA provenance on the TON Blockchain.…

in-toto/in-toto

in-toto is a framework to protect supply chain integrity.

1,050

sigstore/model-transparency

Supply chain security for ML

247

nerves-hub/nerves_hub_web

Manage your Nerves device fleet, including firmware updates, health reports, and interactive device…

273

mindersec/minder

Software Supply Chain Security Platform

422

nsacyber/paccor

The Platform Attribute Certificate Creator can gather component details, create, sign, and validate…

infisical/infisical

Infisical is the open-source platform for secrets, certificates, and privileged access management.

29,609