From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 039E7C10F16 for ; Mon, 6 May 2024 15:40:47 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6058E8835A; Mon, 6 May 2024 17:40:46 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=denx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1715010046; bh=+2KYbOeNpJAm46GOSREgbBX7AnrzgtLyXF9f6YGLRXM=; h=Date:Subject:To:Cc:References:From:In-Reply-To:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=f9duPmqx6ceUEsnX5AkyHAJI4c/Ds7RUohncCPbVQrFuZwfJst4AapuIinrDk+xa5 Ux+8qXlYnArpsxhea/BSTq4dxsKJDLH0rxz2ebWeeTjVqLeS4KqJDCVZ6HJb5N3wzC VYf23UjJMozCDShP7fPjfMWAva7biiE5Xzf1qGlZ3utCRbwYJ9HIsMD6GFFCF2Z8IQ Wp2o5sVwtzkqHHVkncOofiOa35WNmoeb5kyMJRdAI7s5fWWoArgs32s4vE7CW7UsBr LLEx5YvysieUJNEnNwoI5aiR/ds79324qkUh00lj46oSoorOy8yGUa5cz4EzrknfxH a+LI9x25ORlMA== Received: from [127.0.0.1] (p578adb1c.dip0.t-ipconnect.de [87.138.219.28]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: marex@denx.de) by phobos.denx.de (Postfix) with ESMTPSA id 94ED587E75; Mon, 6 May 2024 17:40:44 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1715010046; bh=+2KYbOeNpJAm46GOSREgbBX7AnrzgtLyXF9f6YGLRXM=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=qvmEA7RL3uxaNMQH9VXcoucHppTMaUp6UDUx/9db1S/wl771z7DUOxiRjBbi6pXdr Q05uA0hZBEIbLWQEzLNGwrD8NZO3eyLE8lB4jjpSN0za0n5gO8uZEl1dkXnMTE/OSb mci5pB2spcb6M3mvkWJ98Bny6+MRqXfeA0meaKQhdW+zP7YauP7KB28E2Gx5b4icdT 4y31ceGt4WPayf5RfK2UcHbHU7OEhrEZfQqIe9huYBWzmQqMeyk6K7r7u2JGMlsa6h CmAQFCEM7/B7kg73ruCkbVH+wK8CvGsDucPvi/ljRGXwWTJk7SYG9ZH+p+Y1csTuM7 vk/o+wFT/XGtg== Message-ID: <0155ad86-9eea-4619-8f3b-54907da3ab2e@denx.de> Date: Mon, 6 May 2024 17:21:54 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/4] binman: Add nxp_imx8mcst etype for i.MX8M flash.bin signing To: Francesco Dolcini Cc: u-boot@lists.denx.de, anton.gres@ifm.com, ch@denx.de, "NXP i.MX U-Boot Team" , Adam Ford , Alper Nebi Yasak , Andrejs Cainikovs , Angus Ainslie , Emanuele Ghidoli , Fabio Estevam , Francesco Dolcini , Marcel Ziswiler , Rasmus Villemoes , Simon Glass , Stefan Eichenberger , Stefano Babic , Tim Harvey , Tom Rini , kernel@puri.sm, u-boot@dh-electronics.com References: <20240503010518.263458-1-marex@denx.de> <20240506115227.GA12786@francesco-nb> Content-Language: en-US From: Marek Vasut In-Reply-To: <20240506115227.GA12786@francesco-nb> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean On 5/6/24 1:52 PM, Francesco Dolcini wrote: > Hello Marek, > > On Fri, May 03, 2024 at 03:05:09AM +0200, Marek Vasut wrote: >> Add new binman etype which allows signing both the SPL and fitImage sections >> of i.MX8M flash.bin using CST. There are multiple DT properties which govern >> the signing process, nxp,loader-address is the only mandatory one which sets >> the SPL signature start address without the imx8mimage header, this should be >> SPL text base. The key material can be configured using optional DT properties >> nxp,srk-table, nxp,csf-crt, nxp,img-crt, all of which default the key material >> names generated by CST tool scripts. The nxp,unlock property can be used to >> unlock CAAM access in SPL section. >> >> Signed-off-by: Marek Vasut > > I was not able to test or really look into your series [1], however I can > relate with a comment from Tim Harvey. > > I think is important to keep in mind that that signing cannot be done > with key material that is in-tree, because well, that's private, and I > think we should not force people to branch to properly sign the > binaries. > > I think that it would be valuable to share how do you foresee this used > in a real environment. I am open to discussion, really. Currently the most basic approach is implemented -- plug in key material either by copying it into build directory, or creating a symlink, or adjusting the DT to specify full path to key material. I am sure this can be expanded to cover other use cases ?