Re: [PATCH 3/4] avb: add board-specific root key provider
Mattijs Korpershoek <[email protected]>
| Newsgroups | gmane.comp.boot-loaders.u-boot |
|---|---|
| Message-ID | <[email protected]> |
Hi Igor, Thank you for the patch. On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <[email protected]> wrote: > The strongest anchor for the root of trust is a key hash burned into > hardware (OTP/eFuse), which is inherently SoC-specific and cannot live in > common code. Give boards a hook to supply it from wherever their hardware > keeps it. > > The default is deliberately fail-closed: a board that has not wired up a > provider refuses verification rather than silently trusting whatever key it > is handed. A misconfiguration should stop the boot, not quietly weaken it. > > Signed-off-by: Igor Opaniuk <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> > ---