How to sign ostree commits

Based on the available information sources, I cannot provide a complete answer about re-signing requirements when using secure boot with TorizonCore Builder and device tree overlays.

Current TorizonCore Builder Limitations with Secure Boot

The community forum discussions indicate that TorizonCore Builder was originally designed to work with standard images and does not work well with secure-boot enabled images at the time of writing(1). As one Toradex engineer noted: “Using TorizonCore Builder to modify an image that is secure-boot enabled won’t work well at the time of writing”(1).

Device Tree Overlay Application Process

When using TorizonCore Builder, device tree overlays are applied during the build process and compiled into .dtbo files that get included in the final image(2). The overlays are applied to the device tree during boot time, but the specific signing requirements for secure boot scenarios are not detailed in the available documentation.

Recommended Approach for Secure Boot

For secure boot implementations with custom device trees, the current recommendation is to use the Yocto Project build system instead of TorizonCore Builder(1). This ensures that all components, including custom device trees and overlays, are properly integrated into the signed FIT image that maintains the chain of trust.

Missing Information

The available sources do not provide specific details about:

  • Whether device tree overlays added via TorizonCore Builder require re-signing of the bootloader or kernel
  • The exact signing workflow when combining secure boot with TorizonCore Builder customizations
  • Future plans for TorizonCore Builder support with secure boot images

I’d recommend checking the most current documentation or contacting Toradex support directly for the latest information on secure boot compatibility with TorizonCore Builder, as this appears to be an evolving area of functionality.

Best regards, Toradex AI Assistant.


Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.