Re: [PATCH 2/4] avb: add OP-TEE root key digest provider

Hi Igor,

Thank you for the patch.

On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <[email protected]> wrote:

> When a device already runs OP-TEE, its root-of-trust key should live in the
> same secure, RPMB-backed storage that already holds the AVB rollback
> indexes and lock state, so it is provisioned per device and protected by
> the secure world -- not shipped inside the bootloader image.
>
> Let AVB fetch the trusted digest from the OP-TEE AVB TA. It reuses the
> existing persistent-value interface, so no change to the TA is required,
> and a missing value fails closed.
>
> Signed-off-by: Igor Opaniuk <[email protected]>

Reviewed-by: Mattijs Korpershoek <[email protected]>

> ---