Re: [meta-ti][master/kirkstone][RFC PATCH] conf: machine: include: k3 enable fit signing for uboot

[Denys Dmytriyenko <denis@denix.org>]

On Thu, May 11, 2023 at 01:20:08PM -0300, Ricardo Salveti wrote:
> On Thu, May 11, 2023 at 12:48 PM Denys Dmytriyenko <denis@denix.org> wrote:
> >
> > On Thu, May 11, 2023 at 11:54:00AM +0530, Manorit Chawdhry via lists.yoctoproject.org wrote:
> > > Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
> > > ---
> > > To: Ryan Eatmon <reatmon@ti.com>
> > > To: Denys Dmytriyenko <denys@ti.com>
> > > Cc: meta-ti@lists.yoctoproject.org
> > > Cc: Vignesh Raghavendra <vigneshr@ti.com>
> > > Cc: Praneeth Bajjuri <praneeth@ti.com>
> > > Cc: Udit Kumar <u-kumar1@ti.com>
> > > Cc: Andrew Davis <afd@ti.com>
> > > Cc: Kamlesh Gurudasani <kamlesh@ti.com>
> > > ---
> > >  meta-ti-bsp/conf/machine/include/k3.inc | 6 ++++++
> > >  1 file changed, 6 insertions(+)
> > >
> > > diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc
> > > index fff1550564b3..ab7e45a8016f 100644
> > > --- a/meta-ti-bsp/conf/machine/include/k3.inc
> > > +++ b/meta-ti-bsp/conf/machine/include/k3.inc
> > > @@ -31,6 +31,12 @@ SPL_BINARY = "tispl.bin"
> > >  SPL_BINARYNAME = "tispl.bin"
> > >  UBOOT_SUFFIX = "img"
> > >
> > > +UBOOT_SIGN_ENABLE = "1"
> > > +UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb"
> > > +UBOOT_SIGN_KEYNAME = "uboot_signing_dev_key"
> > > +UBOOT_SIGN_KEYDIR = "${DEPLOY_DIR_IMAGE}/u-boot-keys"
> >
> > How are the keys get into there? Are there extra docs/instructions?
> 
> FIT_GENERATE_KEYS set to 1 forces the key to be automatically
> generated by openembedded-core/meta/classes/uboot-sign.bbclass, so
> they are created during build time.

I know, and that is fine for development, but not so much for production - 
that is why I asked for docs/instructions for someone to deploy their own 
keys and disable autogeneration.

-- 
Denys