Secure application bring-up with hash creation during packaging method and apparatus

A method, comprising:

• causing one or more files that are part of an application to be packaged to form an application package;
• during a packaging process wherein the application package is formed, causing a hash calculator to calculate a hash for the application package and a signing module to generate an application manifest file comprising the hash for the application package;
• causing the application manifest file to be added to the application package;
• causing firmware executed by a processor to verify a bootloader;
• in response to verifying the bootloader, causing the bootloader to be executed to verify a kernel;
• in response to verifying the kernel, causing the kernel to be executed to verify a trust agent;
• in response to verifying the trust agent, causing the trust agent to process an application list to identify the one or more files that are part of the application included in the application package and to generate a hash for the one or more files included in the application package;
• comparing the hash for the one or more files included in the application package with the hash for the application package included in the application manifest file;
• and
• in response to confirming a hash match between the hash for the one or more files included in the application package and the hash included in the manifest file, causing the one or more files that are part of the application to be executed.

A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause an apparatus to:

• cause firmware executed by a processor to verify a bootloader;
• in response to verifying the bootloader, cause the bootloader to be executed to verify a kernel;
• in response to verifying the kernel, cause the kernel to be executed to verify a trust agent;
• in response to verifying the trust agent, cause the trust agent to process an application list to identify one or more files that are part of an application included in an application package and to generate a hash for the one or more files included in the application package;
• compare the hash for the one or more files included in the application package with a hash for the application package included in an application manifest file in a secure storage, wherein the hash for the application package included in the application manifest file is calculated by a hash calculator during a packaging process in which the application package is formed, the hash calculator adds the hash for the application package calculated during the packaging process to the application manifest file, the application manifest file is signed by a signing module, and the application manifest file including the hash for the application package is added to the application package;
• and
• in response to confirming a hash match between the hash for the one or more files included in the application package and the hash for the application package included in the application manifest file, cause the one or more files that are part of the application to be executed.