From: Mattijs Korpershoek <mkorpershoek@kernel.org>
To: Igor Opaniuk <igor.opaniuk@gmail.com>, u-boot@lists.u-boot-project.org
Cc: Tom Rini <trini@konsulko.com>,
Mattijs Korpershoek <mkorpershoek@kernel.org>,
Peter Robinson <pbrobinson@gmail.com>,
Quentin Schulz <quentin.schulz@cherry.de>,
Johan Jonker <jbx6244@gmail.com>,
Igor Opaniuk <igor.opaniuk@gmail.com>
Subject: Re: [PATCH 3/4] avb: add board-specific root key provider
Date: Mon, 10 Aug 2026 11:44:59 +0200 [thread overview]
Message-ID: <87fr0m2tt0.fsf@kernel.org> (raw)
In-Reply-To: <20260727-avb-root-key-pluggable-v1-3-7e27b2b92cc0@gmail.com>
Hi Igor,
Thank you for the patch.
On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
> The strongest anchor for the root of trust is a key hash burned into
> hardware (OTP/eFuse), which is inherently SoC-specific and cannot live in
> common code. Give boards a hook to supply it from wherever their hardware
> keeps it.
>
> The default is deliberately fail-closed: a board that has not wired up a
> provider refuses verification rather than silently trusting whatever key it
> is handed. A misconfiguration should stop the boot, not quietly weaken it.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
> ---
next prev parent reply other threads:[~2026-08-10 9:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-27 17:14 [PATCH 0/4] avb: make the AVB root key source pluggable Igor Opaniuk
2026-07-27 17:14 ` [PATCH 1/4] " Igor Opaniuk
2026-08-10 9:41 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 2/4] avb: add OP-TEE root key digest provider Igor Opaniuk
2026-08-10 9:43 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 3/4] avb: add board-specific root key provider Igor Opaniuk
2026-08-10 9:44 ` Mattijs Korpershoek [this message]
2026-07-27 17:14 ` [PATCH 4/4] doc: android: document the AVB root key source Igor Opaniuk
2026-08-10 9:46 ` Mattijs Korpershoek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fr0m2tt0.fsf@kernel.org \
--to=mkorpershoek@kernel.org \
--cc=igor.opaniuk@gmail.com \
--cc=jbx6244@gmail.com \
--cc=pbrobinson@gmail.com \
--cc=quentin.schulz@cherry.de \
--cc=trini@konsulko.com \
--cc=u-boot@lists.u-boot-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.