Re: [PATCH v6 5/5] binman: Add BINMAN_X509_KEYFILE to override the signing key

On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote:
> binman: Add BINMAN_X509_KEYFILE to override the signing key
>
> The key used to sign an x509 certificate entry comes from the image
> description, either as a 'keyfile' property or as a 'keyfile' entry
> argument. Neither is convenient for a build which must not carry the key,
> such as one signing with an HSM.
>
> Add a BINMAN_X509_KEYFILE make variable which, when set, passes
> '-a keyfile=<value>' to binman and so overrides the image description for
> every x509 certificate entry in the build::
>
>     URI="pkcs11:token=mytoken;object=mykey;type=private"
>     make BINMAN_X509_KEYFILE="$URI" OPENSSL_CONF=/path/to/openssl.cnf
>
> The variable is a plain keyfile override, so it takes a path to a PEM key
> file just as happily as a PKCS#11 URI; signing with an HSM is simply the
> case which needs it most.
>
> Signed-off-by: Sergio Prado <[email protected]>
>
> Makefile                |  1 +
>  tools/binman/binman.rst | 12 ++++++++++++
>  2 files changed, 13 insertions(+)

Reviewed-by: Simon Glass <[email protected]>