Re: [PATCH 0/4] avb: make the AVB root key source pluggable

Hi,

On Mon, 27 Jul 2026 19:14:12 +0200, Igor Opaniuk wrote:
> AVB's entire chain of trust reduces to a single public key, and today that
> key is hard-coded in U-Boot as the AVB reference/test key -- whose private
> half is publicly available. That is fine for development, but it means the
> root of trust for a "locked" device is a key anyone can sign with, and there
> is no way to point AVB at a real, per-device anchor.
> 
> This series makes the source of the trusted root key digest selectable via a
> Kconfig choice (CONFIG_AVB_ROOT_KEY_*), while keeping the actual trust
> decision -- hash the vbmeta key, compare against the trusted digest, fail
> closed on any error -- in one place in validate_vbmeta_public_key():
> 
> [...]

Thanks, Applied to https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu (u-boot-dfu-next)

[1/4] avb: make the AVB root key source pluggable
      https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/83f12ac9d6355b4d843b64f5a92c933da4c94f64
[2/4] avb: add OP-TEE root key digest provider
      https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/b842aab3e2a2a195278239628429b35df112542e
[3/4] avb: add board-specific root key provider
      https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/d57dbfa61be077382f15b2fa70bc7937d514408a
[4/4] doc: android: document the AVB root key source
      https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/c22d53af6344a6313042f70d6e55448e1562dd80

--
Mattijs