tibet-edge — IoT Firmware Sealer

Not just hash verification. Full provenance chain for firmware updates.

Who built it, from what source, on what build server, why this version.

tibet-edge seals firmware images with a complete TIBET provenance chain covering every step from developer to device. A missing step means a rejected update. No exceptions.

The Problem: Hashes Are Not Enough

Everyone verifies firmware hashes. But a hash only proves "the binary hasn't changed." It doesn't prove:

• Who compiled it (intern or senior engineer?)
• What source code it came from (which git commit?)
• Where it was built (CI server or compromised laptop?)
• Why this version exists (security patch or backdoor?)

A supply chain attacker who compromises the build server produces a binary with a perfectly valid hash — of the wrong firmware.

The Firmware Envelope

┌─────────────────────────────────────────────────────────────────────┐
│                     FIRMWARE ENVELOPE                               │
│                                                                     │
│  ┌────────────────────────────────────────────────────────────────┐ │
│  │ FIRMWARE BINARY                                                │ │
│  │ SHA-256: a1b2c3...  Size: 2.4MB  Version: 3.1.7              │ │
│  └────────────────────────────────────────────────────────────────┘ │
│                                                                     │
│  ┌─ BUILD CHAIN (every step = TIBET token) ─────────────────────┐  │
│  │                                                               │  │
│  │  [1] commit    dev@company    git:abc123    → src_hash       │  │
│  │       │                                                       │  │
│  │  [2] compile   ci-server-04   GCC 13.2      → obj_hash      │  │
│  │       │                                                       │  │
│  │  [3] test      ci-server-04   pytest 8.1    → test_hash     │  │
│  │       │                                                       │  │
│  │  [4] sign      hsm-prod-01   ECDSA P-256    → sig_hash      │  │
│  │       │                                                       │  │
│  │  [5] package   ci-server-04   fwtools 2.0   → pkg_hash      │  │
│  │       │                                                       │  │
│  │  [6] release   release-mgr    approved       → rel_hash      │  │
│  │                                                               │  │
│  └───────────────────────────────────────────────────────────────┘  │
│                                                                     │
│  Missing step? → REJECT UPDATE                                      │
│  Broken chain? → REJECT UPDATE                                      │
│  Unknown actor? → REJECT UPDATE                                     │
│                                                                     │
│  TIBET Token: jis:fw:envelope:a1b2c3d4                              │
│  Sealed by:  jis:ci:build-pipeline-prod                             │
│  Sealed at:  2026-02-27T14:00:00Z                                   │
└─────────────────────────────────────────────────────────────────────┘

Install

pip install tibet-edge

Quick Start

from tibet_edge import FirmwareSealer, BuildStep

sealer = FirmwareSealer(actor="ci-pipeline-prod")

# Record each build step
sealer.add_build_step(BuildStep(
    name="compile",
    actor="ci-server-04",
    input_hash="abc123...",
    output_hash="def456...",
    tool="GCC 13.2",
    environment="Ubuntu 24.04",
))

# Seal the firmware
envelope = sealer.seal(
    firmware_path="firmware-v3.1.7.bin",
    version="3.1.7",
    metadata={"reason": "Security patch CVE-2026-1234"},
)

# Verify: every step present, hashes match, chain unbroken
result = sealer.verify(envelope)
print(result.valid)           # True
print(result.steps_verified)  # 6
print(result.missing_steps)   # []

CLI

tibet-edge info           # Concept overview
tibet-edge demo           # Full demo: seal, verify, tamper detection
tibet-edge profiles       # Sector profiles (automotive, medical, etc.)
tibet-edge seal fw.bin    # Seal a firmware file (demo mode if no file)
tibet-edge verify env.json  # Verify a firmware envelope

Use Cases

Sector Profiles

tibet-edge profiles

EU Cyber Resilience Act (CRA) Compliance

tibet-edge's firmware envelope provides the technical evidence required by the EU CRA:

• Article 10(6): Identify and document vulnerabilities — ERACHTER layer records CVE references and patch intent
• Article 10(9): Security updates with provenance — the envelope IS the provenance
• Article 10(10): SBOM compatibility — build chain maps to SBOM components

TIBET Provenance Layers

Target Implementations

• Python — Reference implementation (this package)
• C — Embedded library for constrained devices (planned)
• Rust — Safety-critical embedded systems (planned)

Part of the TIBET Ecosystem

License

MIT — Humotica / J. van de Meent 2025

Authors

• J. van de Meent — jasper@humotica.com
• R. AI (Root AI) — root_idd@humotica.nl

Credits

Designed by Jasper van de Meent. Built by Jasper and Root AI as part of HumoticaOS.

Stack-positie: Groep agentic · Bootstrap = OSAPI-handshake naar tibet + jis (fail → snaft-rule + tibet-pol-rapport) · ← tibet-iot · tibet-mesh → · See STACK.md · See demo/golden-path/ for the spine end-to-end.

Enterprise

For private hub hosting, SLA support, custom integrations, or compliance guidance:

See ENTERPRISE.md for details.