On Wed, Dec 11, 2019 at 08:57:45AM +0100, Maik Otto wrote: > Hi Sascha, > > in my opinion it is better to have it configurable, because ther are > different use cases and security requirements. > i found the problem by creating a sd-card \emmc image with wic. The > mbr, the partition table and bootloader became be signed at barebox > build and wic changes > the partition table at the end of the build process. Then the sd card > image could not boot , because the signature was wrong. yeah secure boot > works :-) > the highest protection you have, when mbr and partition table is signed > with the bootloader, but it is not always necessary. But in which cases is it really necessary? I can't think of any. The mbr and partition table are not evaluated by the ROM code, hence they do not need to be signed for HAB. The images generated by the build system all do not have a partition table included, so basically we are currently enforcing no partition table at all which is just not useful. I think the current way of including the first KiB in signed area comes from the fact that we started doing HAB on a NAND device which doesn't have a partition table. Other projects we are currently doing use eMMC where we use the boot partitions, again no MBR or partition table. If we had started on SD cards, we wouldn't have included the partition table in the signature and also would never have thought it would be a good idea to do so. Regards Sascha -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ barebox mailing list barebox@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/barebox
