[PATCH 2/4] tools: mkeficapsule: remove device-tree related operation

Ilias Apalodimas
2021-05-12T08:01:34Z

On Wed, May 12, 2021 at 04:49:02PM +0900, Masami Hiramatsu wrote:
> Hi Ilias,
>
> 2021?5?12?(?) 16:21 Ilias Apalodimas <ilias.apalodimas@linaro.org>:
> >
> > Akashi-san,
> >
> > On Wed, May 12, 2021 at 01:57:51PM +0900, AKASHI Takahiro wrote:
> > > As we discussed, "-K" and "-D" options have nothing to do with
> > > creating a capsule file. The same result can be obtained by
> > > using standard commands like:
> > > === signature.dts ===
> > > /dts-v1/;
> > > /plugin/;
> > >
> > > &{/} {
> > > signature {
> > > capsule-key = /incbin/("SIGNER.esl");
> > > };
> > > };
> > > ===
> > > $ dtc -@ -I dts -O dtb -o signature.dtbo signature.dts
> > > $ fdtoverlay -i test.dtb -o test_sig.dtb -v signature.dtbo
> > >
> > > So just remove this feature.
> > > (Effectively revert the commit 322c813f4bec ("mkeficapsule: Add support
> > > for embedding public key in a dtb").)
> > >
> > > The same feature is implemented by a shell script (tools/fdtsig.sh).
> >
> >
> > The only reason I can see to keep this, is if mkeficapsule gets included
> > intro distro packages in the future. That would make end users life a bit
> > easier, since they would need a single binary to create the whole
> > CapsuleUpdate sequence.
>
> Hmm, I think it is better to write a manpage of mkeficapsule which
> also describes
> how to embed the key into dtb as in the above example if it is so short.
> Or, distros can package the above shell script with mkeficapsule.
>
> Embedding a key and signing a capsule are different operations but
> using the same tool may confuse users (at least me).

Sure fair enough. I am merely pointing out we need a way to explain all of
those to users.

Thanks!
/Ilias
>
> Thank you,
>
> --
> Masami Hiramatsu