Standalone signing and encrypting of images

To maintain a high level of security, strictly limit the number of people who have access to the private keys to sign the device artifacts. In many cases, this means that only specific persons—signers—have access to them, and these individuals may or may not be part of the development team.

TrustFence standalone signing tools allow you to isolate the signing processes from firmware image generation. This way, there is no need to secure the entire development environment, only a secure location in which the firmware images get signed.

Requirements:

Enable Trustfence in your Yocto project by adding the following line to your local.conf file:
```
INHERIT += "trustfence"
```
Use that project to generate an SDK.
```
~$ bitbake -c populate_sdk dey-image-qt
```

Install the generated SDK and source it.

~$ <YOCTO_PROJECT_FOLDER>/tmp/deploy/sdk/dey-glibc-x86_64-dey-image-qt-xwayland-aarch64-toolchain-2.6-r3.sh
~$ source <SDK_INSTALLATION_PATH>/environment-setup-aarch64-dey-linux

Sign and encrypt U-Boot images

Encryption is not currently supported for the ConnectCore 8X.

Once the toolchain is installed and sourced, you can follow these steps to sign a U-Boot image:

Configure the signature process using the following environment variables:
- CONFIG_SIGN_KEYS_PATH: (Mandatory) The path to the PKI tree. A new PKI tree is generated if an empty folder is specified.
- CONFIG_KEY_INDEX: (Optional) Default value is 0. Index of the key to use for signatures.
  
  You can also define these variables in a file .config located in the current path:
  .config
  CONFIG_SIGN_KEYS_PATH="/path/to/keys" CONFIG_KEY_INDEX="3"
Execute the trustfence-sign-uboot.sh script with the input file (U-Boot image to be signed) as the first parameter and the output file (signed U-Boot image) as the second parameter:
```
~$ trustfence-sign-uboot.sh u-boot.imx u-boot-signed.imx
Using existing PKI tree
Signed image ready: u-boot-signed.imx
```

The tool will also generate the SRK_efuses.bin file for the PKI tree used.

Sign and encrypt other images

Encryption is not currently supported for the ConnectCore 8X.

The trustfence-sign-kernel.sh script allows the following artifacts to be signed and encrypted:

Linux images
DTBs
U-Boot bootscripts
Initramfs

To use the script, follow these steps:

Configure the signature process using the following environment variables:
- CONFIG_SIGN_KEYS_PATH: (Mandatory) The path to the PKI tree. If an empty path is specified, a new PKI tree is generated
- CONFIG_KEY_INDEX: (Optional) Default value is 0. Index of the key to use for signatures.
  
  In a similar way, you can also define these variables in a .config file located in the current path:
  .config
  CONFIG_SIGN_KEYS_PATH="/path/to/keys"

Execute the trustfence-sign-kernel.sh script. Usage of the script is as follows:

Usage: trustfence-sign-kernel.sh [OPTIONS] input-unsigned-image output-signed-image

    -p <platform>    select platform for the project
    -b               sign/encrypt bootscript
    -d               sign/encrypt DTB
    -i               sign/encrypt initramfs
    -l               sign/encrypt Linux image

Supported platforms: ccimx6, ccimx6ul, ccimx8x

The following example signs and encrypts the Image.gz:

trustfence-sign-kernel.sh -p ccimx8x -l Image.gz-signed