Re: [meta-arm] Full secure boot with qemuarm64

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Tue, Jul 15, 2025 at 07:57:28AM +0000, Michael Grand via lists.yoctoproject.org wrote:
> Dear all,
> 
> I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.
> 
> Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?

Check the meta-arm layer and build for example
"kas build ci/qemuarm64-secureboot:ci/uefi-secureboot.yml:ci/testimage.yml"

These build u-boot for UEFI secureboot and then load a UKI binary
signed with matching keys, which includes kernel and initrd.

The testimage part boots the thing with u-boot and checks that
boot was secure. The config files have the details.

Hope this helps,

-Mikko