Secure Boot Reference¶

Complete technical reference for the meta-tolomeo secure boot integration: distro features, include files, classes, recipe variables, and recipes.

DISTRO_FEATURES¶

Feature	What it activates
`secure-boot`	HAB/AHAB U-Boot config fragments, FIT image signing (`UBOOT_SIGN_ENABLE=1`), and the `imx-boot-signature` recipe on NXP targets

Class	Layer	Scope	Purpose
`xhab.bbclass`	`meta-tolomeo-nxp`	NXP signing recipes	Maps machine family to signing protocol (`hab4` or `ahab`) and SPSDK family name
`sigtool.bbclass`	`meta-tolomeo-nxp`	NXP signing recipes	Validates that the correct signing tool (CST for HAB4, SPSDK for AHAB) is installed at `SIG_TOOL_PATH`
`kernel_fitimage_mcore.bbclass`	`meta-tolomeo-nxp`	Kernel recipes	Builds and RSA-signs FIT images containing the kernel, DTBs, and optional M-core firmware

File	Layer	Used in	Purpose
`conf/machine/include/u-boot-secure-boot.inc`	`meta-tolomeo-bsp`	Machine `.conf`	Sets `UBOOT_SIGN_ENABLE`, `UBOOT_SIGN_KEYDIR`, `UBOOT_SIGN_KEYNAME`, `UBOOT_FIT_GENERATE_KEYS`
`recipes-bsp/u-boot/u-boot-fit-signature.inc`	`meta-tolomeo-bsp`	U-Boot bbappend (generic BSP)	Conditionally adds `fit-signature.cfg` fragment enabling `CONFIG_FIT_SIGNATURE=y`
`recipes-bsp/u-boot/u-boot-secure-boot.inc`	`meta-tolomeo-nxp`	`u-boot-imx_%.bbappend`	Wrapper that requires both `u-boot-fit-signature.inc` and `u-boot-hab.inc`
`recipes-bsp/u-boot/u-boot-hab.inc`	`meta-tolomeo-nxp`	Via `u-boot-secure-boot.inc`	Adds `CONFIG_IMX_HAB=y` (mx8-generic-bsp) or `CONFIG_AHAB_BOOT=y` (mx9-generic-bsp)

Variable	Default	Set in	Description
`SIG_TOOL_PATH`	—	kas / local.conf	Path to the CST (HAB4) or SPSDK (AHAB) installation directory
`SIG_DATA_PATH`	`${SIG_TOOL_PATH}`	kas / local.conf	Directory containing the signing configuration file; falls back to `SIG_TOOL_PATH`
`AHAB_CFGFILE`	`spsdk_ahab.yaml`	bbappend / local.conf	Filename of the SPSDK AHAB signing configuration
`HAB4_CFGFILE`	`csf_hab4.cfg`	bbappend / local.conf	Filename of the CST HAB4 signing configuration
`BOOT_VARIANT`	—	kas / local.conf	Optional suffix appended to the boot image name
`BOOT_SIGN_TYPE`	derived (`xhab`)	read-only	Signing protocol for the target machine: `hab4` or `ahab`
`SPSDK_FAMILY`	derived (`xhab`)	read-only	SPSDK family identifier for the target device (e.g. `mimx9352`)

Variable	Default	Set in	Description
`UBOOT_SIGN_ENABLE`	derived	read-only	`"1"` when `secure-boot` is in `DISTRO_FEATURES`, otherwise `"0"`
`UBOOT_SIGN_KEYDIR`	`"keys"`	machine conf / kas	Directory containing the FIT signing key pair, relative to `${BSPDIR}`
`UBOOT_SIGN_KEYNAME`	`"dev"`	machine conf / kas	Base name of the key pair; build reads `<name>.key` and `<name>.crt`
`UBOOT_SIGN_IMG_KEYNAME`	—	machine conf / kas	Base name for a separate key used to sign individual FIT image nodes
`UBOOT_FIT_GENERATE_KEYS`	`"0"`	machine conf	Set to `"1"` to auto-generate keys at build time (development only)

Recipe	Layer	Requires	Output
`imx-boot-signature`	`meta-tolomeo-nxp`	`secure-boot` distro feature	`signed-imx-boot-<machine>.bin` in the deploy directory
`nxp-imx-signer`	`meta-tolomeo-nxp`	—	`imx_signer` tool binary in `deploy/imx-boot-tools/`