Linux DT signing issue

[psingh3086]

Hi Team,
Continue with ticket #458 . we got to know that ARM is working to provide some alternative solution for above issue. can you update what would be solution?

[chetan-rathore]

Hi @psingh3086,

We are investigating on refactoring scripts to enable building systemready images with a non ACS key.

For you case I want to understand, how the DT blob is passed to OS.

On most other systems, my understanding is that the DTB is typically passed as part of the firmware or through the standard firmware-to-OS handoff, and we have not had to handle it as a separately signed artifact.

Thanks,
Chetan

[psingh3086]

We are implementing DT signing at compile time, and during UEFI execution, we load the DT image and authenticate it.

[chetan-rathore]

@psingh3086, Can you please elaborate a bit. :)

[psingh3086]

DTB Verification Flow:

1. Load DTB file (e.g., combined-dtb.dtb)
2. Load signature file (e.g., combined-dtb.sig)
3. Verify signature using platform keys
4. If verification fails → Boot fails
5. If verification succeeds → Continue boot

We perform DT authentication before loading the kernel. currently we are adding DTB during compile time
If you have any specific question, please let me know.

[sathishas89]

Hi @psingh3086,

To sign the Linux DT with your custom keys, please follow the steps provided in the README file from the branch below. Also, please generate the DT image using my forked branch with your custom keys, verify it on your platforms, and share your feedback with us.

https://github.com/sathishas89/arm-systemready/tree/feature/common/secureboot-partner-key-override

https://github.com/sathishas89/arm-systemready/blob/feature/common/secureboot-partner-key-override/SystemReady-devicetree-band/README.md

[sathishas89]

@psingh3086, any update on this issue?

[psingh3086]

Hi Sathis,
we will share you update soon.

[sathishas89]

Hi @psingh3086 ,
Any update on this issue?

[psingh3086]

we are getting issue during image compilation. we will update

[sathishas89]

Hi @psingh3086 ,
Any update on this issue?
Now the same changes are up streamed to main branch, you can directly use main to build the image.

[smangali-qc]

HI @sathishas89 ,

Thank you for mainlining the changes. We are now able to compile the build successfully and will share the results shortly.

As per our understanding, we need to recompile the images to use the generated keys. Could you please confirm if this approach is acceptable for compliance, i.e., validating tests on recompiled images instead of prebuilt binaries?

Regards,
Shiva Kumar

[chetan-rathore]

Hi @smangali-qc,

Using the pre-built image is the recommended approach for compliance. However, I will check your query internally and provide an update.

Regards,
Chetan

[sathishas89]

Hi Shiva Kumar,
What is the update on verification results?

Regards,
Sathisha S