Hi Sascha, so do you think we should always start from-dcdofs instead of full? at the moment i use this configuration with from-dcdofs and i think you have right, there is not really a good case to sign the area between 0x00 and dcdofs in the barebox build What is the best solution in your opinion? change default from full to dcdofs in the scripts/imx/imx.c ? additional delete full and skip-mbr ? Best regards Maik Am 11.12.2019 um 09:15 schrieb Sascha Hauer: > On Wed, Dec 11, 2019 at 08:57:45AM +0100, Maik Otto wrote: >> Hi Sascha, >> >> in my opinion it is better to have it configurable, because ther are >> different use cases and security requirements. >> i found the problem by creating a sd-card \emmc image with wic. The >> mbr, the partition table and bootloader became be signed at barebox >> build and wic changes >> the partition table at the end of the build process. Then the sd card >> image could not boot , because the signature was wrong. yeah secure boot >> works :-) >> the highest protection you have, when mbr and partition table is signed >> with the bootloader, but it is not always necessary. > But in which cases is it really necessary? I can't think of any. The mbr > and partition table are not evaluated by the ROM code, hence they do not > need to be signed for HAB. > > The images generated by the build system all do not have a partition table > included, so basically we are currently enforcing no partition table at > all which is just not useful. > > I think the current way of including the first KiB in signed area comes > from the fact that we started doing HAB on a NAND device which doesn't > have a partition table. Other projects we are currently doing use eMMC > where we use the boot partitions, again no MBR or partition table. > > If we had started on SD cards, we wouldn't have included the partition > table in the signature and also would never have thought it would be a > good idea to do so. > > Regards > Sascha > _______________________________________________ barebox mailing list barebox@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/barebox
