[PATCH 0/4] avb: make the AVB root key source pluggable

[Igor Opaniuk <igor.opaniuk@gmail.com>]

AVB's entire chain of trust reduces to a single public key, and today that
key is hard-coded in U-Boot as the AVB reference/test key -- whose private
half is publicly available. That is fine for development, but it means the
root of trust for a "locked" device is a key anyone can sign with, and there
is no way to point AVB at a real, per-device anchor.

This series makes the source of the trusted root key digest selectable via a
Kconfig choice (CONFIG_AVB_ROOT_KEY_*), while keeping the actual trust
decision -- hash the vbmeta key, compare against the trusted digest, fail
closed on any error -- in one place in validate_vbmeta_public_key():

  - BUILTIN (default): SHA-256 of the built-in avb_root_pub blob. Unchanged
    behaviour, still the dev/test key, so nothing changes for existing users.
  - TEE: read the digest from OP-TEE secure storage (the same RPMB-backed
    store that already holds the rollback indexes and lock state), via the
    existing AVB TA persistent-value interface. No TA change required.
  - BOARD: a __weak hook a SoC/board overrides to read the digest from
    wherever its hardware keeps it (e.g. a hash fused into OTP/eFuse or
    U-Boot proper dtb). The default fails closed, so a board that forgets
    to wire it up refuses verification rather than silently trusting a
    wrong key.

The last patch documents the choice and its security caveats in
doc/android/avb2.rst (built-in key is dev-only; a TEE-stored digest is only
an anchor if the TA refuses to overwrite it while unlocked; the board
provider fails closed).

Note this only concerns *where the root key comes from*; it does not by
itself make verification enforcing -- device lock state and rollback
protection are still only enforced when backed by OP-TEE.

Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
---
Igor Opaniuk (4):
      avb: make the AVB root key source pluggable
      avb: add OP-TEE root key digest provider
      avb: add board-specific root key provider
      doc: android: document the AVB root key source

 common/Kconfig       | 50 ++++++++++++++++++++++++++++++++++++
 common/avb_verify.c  | 72 +++++++++++++++++++++++++++++++++++++++++++++++++---
 doc/android/avb2.rst | 37 +++++++++++++++++++++++++++
 include/avb_verify.h | 19 ++++++++++++++
 4 files changed, 175 insertions(+), 3 deletions(-)
---
base-commit: e6f091a208276db72596c8f7376648856a276d97
change-id: 20260727-avb-root-key-pluggable-4c2c17dd3218

Best regards,
--  
Igor Opaniuk <igor.opaniuk@gmail.com>