cerberus-pfr: change recovery/update images are signed by CSK key

To support key cancellation, the recovery/update images should be signed by CSK key. By default, it uses CSK key, pricsk0_2048.pem, signing recovery/update image. Signed-off-by: Jamin Lin <[email protected]> Change-Id: Ie97b88db77c0c7810a9534113cac9b110298a205
AspeedTech-BMC · Mar 28, 2023 · 4de5af4 · 4de5af4
1 parent 0bcb135
commit 4de5af4
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/...ge/cerberus-pfr-key-cancellation-image/key_management_tools/cancel_key_manifest0_keys.xml b/...ge/cerberus-pfr-key-cancellation-image/key_management_tools/cancel_key_manifest0_keys.xml
@@ -1,7 +1,7 @@
 <CancellationImage version="08.04" platform="Server-BMC" type="4">
   <!-- Cancel keys in key manifest 0 -->
   <CancellationSection>
-      <CancellationPolicy>BMC</CancellationPolicy> <!-- BMC or PCH -->
+      <CancellationPolicy>BMC</CancellationPolicy> <!-- BMC, PCH, or ROT -->
       <HashType>SHA256</HashType>
       <Key>
           <KeyId>2</KeyId>

diff --git a/...ge/cerberus-pfr-key-cancellation-image/key_management_tools/cancel_key_manifest1_keys.xml b/...ge/cerberus-pfr-key-cancellation-image/key_management_tools/cancel_key_manifest1_keys.xml
@@ -1,7 +1,7 @@
 <CancellationImage version="08.04" platform="Server-BMC" type="4">
   <!-- Cancel keys in key manifest 1 -->
   <CancellationSection>
-      <CancellationPolicy>BMC</CancellationPolicy> <!-- BMC or PCH -->
+      <CancellationPolicy>BMC</CancellationPolicy> <!-- BMC, PCH or ROT -->
       <HashType>SHA256</HashType>
       <Key>
           <KeyId>0</KeyId>

diff --git a/...-utility/cerberus-pfr-signing-utility/recovery_tools/obmc_recovery_image_generator.config b/...-utility/cerberus-pfr-signing-utility/recovery_tools/obmc_recovery_image_generator.config
@@ -1,5 +1,5 @@
 Xml=obmc_recovery_image.xml
 InputImage=image-mtd-pfr
 Output=obmc_recovery_image.bin
-Key=prikey_2048.pem
+Key=pricsk0_2048.pem
 KeySize=256