From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
To: Simon Glass <sjg@chromium.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>,
Masami Hiramatsu <masami.hiramatsu@linaro.org>,
AKASHI Takahiro <takahiro.akashi@linaro.org>,
Alexander Graf <agraf@csgraf.de>,
Sughosh Ganu <sughosh.ganu@linaro.org>,
U-Boot Mailing List <u-boot@lists.denx.de>
Subject: Re: [PATCH 2/3] mkeficapsule: Remove dtb related options
Date: Sat, 17 Jul 2021 10:24:05 +0300 [thread overview]
Message-ID: <YPKFlZNO4XWMQbzn@apalos.home> (raw)
In-Reply-To: <CAPnjgZ22B+EHLsbv9R0h1QF4VMQXdyuKL8VeZnNuDGpteA--nA@mail.gmail.com>
On Fri, Jul 16, 2021 at 08:03:23AM -0600, Simon Glass wrote:
> Hi Ilias,
>
> On Thu, 15 Jul 2021 at 11:00, Ilias Apalodimas
> <ilias.apalodimas@linaro.org> wrote:
> >
> > commit 322c813f4bec ("mkeficapsule: Add support for embedding public key in a dtb")
> > added a bunch of options enabling the addition of the capsule public key
> > in a dtb. Since now we embeded the key in U-Boot's .rodata we don't this
> > this functionality anymore
> >
> > Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> > ---
> > tools/mkeficapsule.c | 226 ++-----------------------------------------
> > 1 file changed, 7 insertions(+), 219 deletions(-)
>
> Here again I see EFI diverging from the impl in U-Boot. WIth U-Boot
> you can add the public key after the build step, e.g. in a key-signing
> server. With EFI and this change you will have to rebuild U-Boot (from
> source) every time you sign something. Seems like a pain.
I don't see why either of this is a problem. You need the public key to
update the binary it self, so rebuilding from source is a prerequisite.
Apart from a signing server, you can also have special hardware that provides
the public key you need (which is not implemented yet). So this is the bare
minimum functionality you need for authenticated capsule updates.
Regards
/Ilias
>
> Regards,
> Simon
next prev parent reply other threads:[~2021-07-17 7:24 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-15 17:00 [PATCH 1/3] efi_capsule: Move signature from DTB to .rodata Ilias Apalodimas
2021-07-15 17:00 ` [PATCH 2/3] mkeficapsule: Remove dtb related options Ilias Apalodimas
2021-07-16 5:57 ` Masami Hiramatsu
2021-07-16 13:53 ` Takahiro Akashi
2021-07-16 14:03 ` Simon Glass
2021-07-17 7:24 ` Ilias Apalodimas [this message]
2021-07-20 18:33 ` Simon Glass
2021-07-20 18:43 ` Ilias Apalodimas
2021-07-20 18:50 ` Simon Glass
2021-07-15 17:00 ` [PATCH 3/3] doc: Update CapsuleUpdate READMEs Ilias Apalodimas
2021-07-16 6:50 ` Heinrich Schuchardt
2021-07-16 7:09 ` Ilias Apalodimas
2021-07-16 12:33 ` AKASHI Takahiro
2021-07-16 5:57 ` [PATCH 1/3] efi_capsule: Move signature from DTB to .rodata Masami Hiramatsu
2021-07-16 13:39 ` Takahiro Akashi
2021-07-17 11:35 ` Ilias Apalodimas
2021-07-17 14:14 ` Ilias Apalodimas
2021-07-16 6:44 ` Sughosh Ganu
2021-07-16 13:49 ` Simon Glass
2021-07-17 11:36 ` Ilias Apalodimas
2021-07-17 14:26 [PATCH 1/3 v2] " Ilias Apalodimas
2021-07-17 14:26 ` [PATCH 2/3] mkeficapsule: Remove dtb related options Ilias Apalodimas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YPKFlZNO4XWMQbzn@apalos.home \
--to=ilias.apalodimas@linaro.org \
--cc=agraf@csgraf.de \
--cc=masami.hiramatsu@linaro.org \
--cc=sjg@chromium.org \
--cc=sughosh.ganu@linaro.org \
--cc=takahiro.akashi@linaro.org \
--cc=u-boot@lists.denx.de \
--cc=xypron.glpk@gmx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.