Firmware · Compliance QA
Firmware

Protected Firmware Asset Management and Download Service.

Verified and documented Software Bill of Materials for the Shopify ecosystem. Your firmware is never a file at a URL: it is vaulted under per-image encryption, every upload is certified, every download is granted, and every event lands in a tamper-evident ledger — the evidence chain the EU Cyber Resilience Act assumes you already have.
What it is
Firmware distribution today is mostly a signed installer behind a storage link — a URL that, once shared, is shared forever, with no record of who fetched it or when. This service replaces the link with a grant. A firmware image enters through an encrypted vault and only leaves through a two-step authorization gate. In between, three records outlive the transaction: a registry row (product, version, size, full SHA-256, linked SBOM), an upload certificate (Ed25519-signed proof of what was vaulted, by whom, when), and a hash-chained access ledger — every grant, every denial, every served byte-stream, each row sealing the one before it.
We are Shopify platform native — purchase, receipt, and order records ride your existing store checkout, not a parallel billing stack — and we work upstream with your software systems: SBOMs flow in from your firmware build (Yocto, Zephyr) or binary analysis (EMBA, cve-bin-tool), certificates verify in any stack against a public JWKS endpoint, and every function here is an API your CI can call.
Rule-based security · order of execution

Two pipelines. Every step must pass.

Upload — how an image is vaulted:
  1. Authorization — platform key or a signed-in account holding the Firmware Security capability. No capability, no vault: the request ends with a purchase path, not a partial upload.
  2. Digest — full SHA-256 of every byte; the image's identity for life.
  3. Encrypt — AES-256-GCM under a random content key generated for this image alone.
  4. Wrap — the content key is itself encrypted under a versioned derived key; ciphertext and wrapped key are stored apart, useless alone.
  5. Ledger — the upload event seals into the hash chain.
  6. Certify — an Ed25519 attestation binds product, version, digest, uploader, and the linked SBOM.
  7. Register — the registry row lands in the system of record.
  8. Publish provenance — digest + certificate + chain tip go public. No key material, no download path.
Download — the verification order:
  1. Grant check against the image's capability — denials are recorded too.
  2. Single-use window — a 120-second signed token bound to this image, key version, and a per-fetch serial.
  3. Token verification — right image, right key version; a rotation kills every earlier token instantly.
  4. Server-side decrypt — the key never leaves the server; ciphertext, URL, or an expired token yields nothing.
  5. Serve + ledger — who, when, how many bytes, which serial.
  6. Client verification — hash what arrived, compare to provenance, verify the certificate against /.well-known/jwks.json. No account, no trust in us required.
Healing: a suspected leak is answered by key rotation — ciphertext untouched, every previously issued wrapped key and token dead at once.
Why we are secure
Most “secure delivery” is a promise about infrastructure. Ours is a property of the data path. The image is encrypted before it is stored, so storage compromise yields ciphertext. The decryption key is wrapped and versioned, so exposure heals with one rotation instead of a re-upload. Access is a capability held by a subject — a person, a teammate, an agent — not a link, so it is granted, audited, and revoked per subject in real time. Identity itself rides a double-key system: PKCE proves the human at sign-in with no client secret to steal, and JWE seals the actor's identity so it is only ever read server-side; logout revokes the session token immediately, everywhere. And every one of these decisions writes a ledger row whose hash includes the row before it — the history cannot be quietly edited, only visibly broken.
Where each layer lands in CRA reporting
SBOM per image
Identify and document components; SBOM available to authorities on request — Annex I Part II; BSI TR-03183-2
Upload certificate
Integrity and provenance evidence for the product placed on the market — Annex I secure-by-design documentation
Hash-chained ledger
“Who accessed what while vulnerable” — the factual basis of Article 14 reporting: 24-hour early warning / 72-hour notification / 14-day final report, in force 11 September 2026
Grant-gated download
Control of the distribution channel; a secure update mechanism you can attest — Annex I secure updates, access control
Key rotation
Vulnerability handling: remediate without recall — leaked credentials die server-side (Annex I Part II)
Register + receipts
Demonstrable conformity trail for market surveillance — Articles 13–14; groundwork for the Declaration of Conformity by 11 December 2027 (Commission overview)
Receipt of transaction
Purchase
Native Shopify checkout; the order is your commercial record. Payment mints the entitlement automatically — no manual provisioning.
Upload
The Ed25519 certificate arrives by email with a public verify link — the same proof-of-record notifications the attestation demos send.
Download
Each serve carries a serial in the response headers and a matching ledger row; the verification register is the chain of custody per certificate.
Verification
Anyone verifies any certificate at /license/verify against the published public key. No account. No trust in the platform required.
Upload panel

Checking your access…

Firmware vault wizard
This is for an asset.Seals the file itself — encrypted per image, released only under a per-device or per-subject grant, with every grant, denial, and served byte-stream recorded. To publish a shareable link instead, use the Channel wizard.

Vaulting is immutable per version — a new build is a new record, never an overwrite. 8 MB max here; the API takes larger images. Accepts: .exe, .bin, .img, .hex, .dfu, .zip — and 3D print formats .stl, .glb, .gltf, .obj, .3mf.

Who can see the proof card? The payload is always grant-gated — these settings govern the public proof layer and where the badge may embed. Stored as JSON on the record, queryable in BigQuery.

Per-person download access is a grant, not a link — minted automatically on purchase, or invited per subject by the platform. Every grant and denial lands in the ledger.

Vault an image first — the embed code for its verified badge appears here.

One snippet works on Webflow, WordPress, Shopify, and any HTML page — paste it where the badge should render.

Your build system made the SBOM — this pushes it into the registry and links it to a vaulted image. Nothing is composed by hand: generation stays in version control (CI from the lockfile; Yocto / Zephyr / EMBA for firmware), so the document can never drift from the build.

CI key ceremony — mint the long-lived credential your pipeline pushes with. It is shown exactly once; put it in your CI secret store (e.g. GitHub Actions secret SBOM_CI_KEY) the moment you see it. We keep no copy — it verifies against our published public keys.

Everything you have vaulted — proof links and embed code per record.

Nothing vaulted yet.

Compliance QAOpen in a new tab ↗
Glossary · Firmware & SBOM security

Formats & upload

MIME type #
A two-part type/subtype label a server sends so a client knows how to handle a file's bytes. The vault stores the declared MIME type as metadata but never lets it drive rendering — downloads are forced and sniffing is blocked (see nosniff). Accepted upload types:
.exe
application/vnd.microsoft.portable-executable — Windows PE executable
.bin · .img · .dfu · .fw
application/octet-stream — raw firmware image; no browser-known type
.hex
Intel HEX (ASCII); served as octet-stream
.zip
application/zip
.tar
application/x-tar
.gz
application/gzip
.stl
model/stl — 3D print mesh
.glb
model/gltf-binary
.gltf
model/gltf+json
.obj
model/obj
.3mf
model/3mf — 3D Manufacturing Format
Immutable vaulting #
A vaulted version is a fact, not a mutable file. A new build is a new record (product-fw-version), never an overwrite — re-vaulting an existing slug is refused (409). This is what makes the SHA-256 a permanent identity.
8 MB browser cap #
The in-page uploader caps at 8 MB. Larger images push through the API (POST /firmware/vault) or the CI relay — the cap is a browser-memory limit, not a product limit.

Security model

Envelope encryption (vaulting) #
Each image is encrypted under a random per-image content key; that key is itself encrypted (“wrapped”) under a versioned derived key. Ciphertext and wrapped key are stored apart — useless alone. Storage compromise yields ciphertext, not firmware.
AES-256-GCM #
The symmetric cipher used for the payload: 256-bit key, authenticated (GCM) so tampering is detectable on decrypt. Applied before anything is written to storage.
CEK / KEK #
Content-Encryption Key (encrypts the image, one per image) and Key-Encryption Key (wraps the CEK, versioned). Separating them means a suspected leak is healed by re-wrapping under a new KEK version — the ciphertext never moves.
Ed25519 certificate #
A signed attestation binding product, version, digest, uploader, and linked SBOM at vault time. Anyone verifies it against the public JWKS — no account, no trust in the platform required.
Hash-chained ledger #
Every upload, grant, denial, and served byte-stream is a row whose hash includes the row before it. History can't be quietly edited — only visibly broken. This is the factual basis of CRA incident reporting.
Key rotation (healing) #
A suspected leak is answered by bumping the key version and re-wrapping the CEK. Ciphertext is untouched; every previously issued wrapped key and download token dies at once — remediation without a recall.

Access & identity

Grant (grant-gated) #
Download access is a capability held by a subject — a person, teammate, or agent — not a shareable link. It is granted, audited, and revoked per subject in real time; every grant and denial lands in the ledger.
PKCE #
Proof Key for Code Exchange — proves the human at sign-in with no client secret to steal. Half of the double-key identity model.
JWE #
JSON Web Encryption — seals the actor's identity so it is only ever read server-side. The other half of the identity model; the token is never legible in the browser.
JWKS #
The public key set at /.well-known/jwks.json that anyone uses to verify a certificate. Published; carries no private key material.

Web-delivery security

CORS (restricted) #
Cross-Origin Resource Sharing — the browser rule that a page on one origin may only read another origin's response if that server opts in via Access-Control-Allow-Origin. Here it is paired with restricted embedding: a vaulted image's proof badge loads only on the domains you allowlist in the Access tab (empty = any). The encrypted payload itself is never cross-origin readable — it is single-use, server-decrypted, and delivered as a forced download.
nosniff #
X-Content-Type-Options: nosniff tells the browser not to guess a response's type and override the declared one. On the payload path it stops a file from being reinterpreted as HTML or script.
Content-Disposition: attachment #
Instructs the browser to download a response rather than render it in place. Every decrypted payload is served this way, so a file can never execute on our origin — the serve-path defense against stored XSS.

Compliance

SBOM #
Software Bill of Materials — a machine-readable ingredient list (CycloneDX or SPDX) for an app release or firmware image, generated in CI so it stays current. The registry is where they live.
Cyber Resilience Act #
EU Regulation 2024/2847. Reporting obligations begin 11 Sep 2026; full obligations 11 Dec 2027. It assumes an evidence chain — SBOMs, provenance, an access record — that this service produces as a by-product of normal use.
CycloneDX #
An SBOM format (ECMA-424). The default the registry generates and vulnerability-scans.
SPDX #
An SBOM format (ISO/IEC 5962). Accepted alongside CycloneDX; either satisfies the CRA SBOM row.
No term matches that search.

See also

Practical guidance, not legal advice. CRA scope — especially whether your device is default category or Class I/II — is confirmed with counsel as part of the CRA Readiness Assessment.