On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote: > binman: Add BINMAN_X509_KEYFILE to override the signing key > > The key used to sign an x509 certificate entry comes from the image > description, either as a 'keyfile' property or as a 'keyfile' entry > argument. Neither is convenient for a build which must not carry the key, > such as one signing with an HSM. > > Add a BINMAN_X509_KEYFILE make variable which, when set, passes > '-a keyfile=<value>' to binman and so overrides the image description for > every x509 certificate entry in the build:: > > URI="pkcs11:token=mytoken;object=mykey;type=private" > make BINMAN_X509_KEYFILE="$URI" OPENSSL_CONF=/path/to/openssl.cnf > > The variable is a plain keyfile override, so it takes a path to a PEM key > file just as happily as a PKCS#11 URI; signing with an HSM is simply the > case which needs it most. > > Signed-off-by: Sergio Prado <[email protected]> > > Makefile | 1 + > tools/binman/binman.rst | 12 ++++++++++++ > 2 files changed, 13 insertions(+)
Reviewed-by: Simon Glass <[email protected]>
