Re: [PATCH 0/6] k3-binman ergonomics

[Anshul Dalal <anshuld@ti.com>]

On Fri Jul 10, 2026 at 6:06 PM IST, Rasmus Villemoes wrote:
> When trying to hook up use of a customer's own signing infrastructure
> for some am62x devices, I found it was more difficult than it should
> be to point at the right key(s). One has to patch in the keyfile=
> property in way too many places, and if you miss just one, the build
> succeeds using the generic custMpk.pem for the one you missed, but of
> course the resulting artifacts are unbootable.
>

The default value for keyfile i.e custMpk.pem is generated via binman
from the custMpk node in binman (defined in k3-binman.dtsi), modifying
the filepath to your custom key should work as a single line change as
is.

Perhaps this could be made more clear by the use of a macro instead of
hardcoding the string "custMpk.pem" in all the places to make it more
obvious.

Other than that, the addition of configurable distinguished-name could
be valuable addition, do you have any specific use case asides from
downstream boards? I wonder if it could be valuable for existing
upstream platforms from Toradex/Phytec.

CC+: Francesco, Wadim

> Use the template mechanism that binman already has to allow one to
> only set the keyfile= in a single place. I cannot really imagine any
> case where one would not want to use the same key for signing all
> artifacts across the r5/a53 cores, but that is of course still
> possible, just as any downstreams that have explicit
>
> &{/binman/tiboot3-am62x-hs-evm.bin/ti-secure-rom} {
>     keyfile = "foobar.pem";
> };
>
> &{/binman/tiboot3-am62x-hs-fs-evm.bin/ti-secure-rom} {
>     keyfile = "foobar.pem";
> };
>
> will continue to work.
>
> Rasmus Villemoes (6):
>   binman: openssl: refactor creation of Distinguished Name section from
>     dict
>   binman: x509_cert: allow and parse distinguished-name subnode
>   binman: x509: fix CN emitted for basic x509 certificates
>   k3-binman.dtsi: add keyfile_template node
>   k3-binman.dtsi: add empty distinguished_name_template
>   k3-binman.dtsi: insert keyfile and distinguished name templates in all
>     ti-secure(-rom) nodes
>
>  arch/arm/dts/k3-binman.dtsi              | 34 +++++++++++-----
>  tools/binman/btool/openssl.py            | 51 ++++++++----------------
>  tools/binman/etype/ti_secure.py          |  3 +-
>  tools/binman/etype/ti_secure_rom.py      |  3 +-
>  tools/binman/etype/x509_cert.py          |  8 +++-
>  tools/binman/test/security/x509_cert.dts |  5 ++-
>  6 files changed, 55 insertions(+), 49 deletions(-)