# Sign images and copy (.Auth) key/signed files to EFI partition

Source: [https://docs.qualcomm.com/doc/80-70014-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html](https://docs.qualcomm.com/doc/80-70014-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html)

The EFI system partition consists of EFI, loader, and dtb directories with
        information relevant to the EFI when using the systemd-boot.

The procedure provides instructions to:
- Sign various images
- Copy `(.auth)` key and signed files to EFI partition
                    directory

- Signed and executable images such as the `bootaa64.efi` file
                        (systemd-boot) are placed in the \EFI\BOOT\ directory
                        and the `uki.efi` file (Linux) image is placed in the
                            `\EFI\Linux\`.

In addition to validating signed images, systemd-boot is used to enroll keys.
- UEFI secure boot keys are placed in a specific folder in
                        /keys for key enrollment. The systemd-boot uses these
                    keys and provisions them in the RPMB or UEFI variable store during UEFI boot
                    time services.

- You can configure the wait time (in seconds) in the systemd-boot loader
                    configuration. Kernel loading is delayed during the wait time, allowing you to
                    review and select available options in the systemd-boot menu.

Device tree files are stored in the /dtb folder. These files are
            used by UEFI during runtime, and the device tree files are initialized. While signing,
                `.sig` files are created and placed in the same folder as these files
            are non-PE images.

| EFI system partition (efi.bin) | EFI system partition (efi.bin) | EFI system partition (efi.bin) |
| --- | --- | --- |
| /EFI | /Loader | /dtb |
| /Boot - bootaa64.efi | loader.conf | <ul class="ul" id="sign_images_and_copy_auth_key_signed_files_to_efi_partition__ul_rvs_gcr_pbc"><br>                                    <li class="li">Chipset DTB file.</li><br><br>                                    <li class="li">Signature file for each DTB file.</li><br><br>                                </ul> |
| /Linux - uki.efi | /keys<br>-/authkeys<br><br><br>PK.auth<br><br><br>KEK.auth<br><br><br>db.auth | <ul class="ul" id="sign_images_and_copy_auth_key_signed_files_to_efi_partition__ul_rvs_gcr_pbc"><br>                                    <li class="li">Chipset DTB file.</li><br><br>                                    <li class="li">Signature file for each DTB file.</li><br><br>                                </ul> |
|  |  |  |

Follow these steps to place the signed images and keys in an EFI partition on a Linux
            host machine:

1. Locate the `efi.bin` file path in the `contents.xml`,
                file to obtain the `efi.bin` file from the meta.
2. Mount the `efi.bin` file into the
                `<workspace>`directory and create an
                    `efimountedbin` folder within the`<workspace>`
                directory.
3. Mount the `efi.bin`
                file:

        sudo mount efi.bin efimountedbinCopy to clipboard

        cd efimountedbinCopy to clipboard
4. Create an authkeys folder within the
                    &lt;workspace&gt;/efimountedbin/loader/keys directory to
                enroll keys.
5. Select and copy the `.auth` files (`PK.auth`,
                    `KEK.auth`, and `db.auth`) to the authkeys
                folder.

        sudo cp <selected algo PK/KEK/DB auth files from the files location> 
        <workspace>/efimountedbin/loader/keys/authkeys/Copy to clipboard
6. Sign the `bootaa64.efi, uki.efi and dtb` image files with the keys
                and copy to the respective folders in the efimountedbindirectory.
    1. Sign `efi` images:
        The sbsign tool is designed for signing
                            EFI boot images, such as `bootaa64.efior UKI.efi`, that
                            follow EFI specifications. This tool, which is specifically used for
                            UEFI secure boot signing, is available for download and use on Linux
                            systems. It is important to note that sbsign can only sign PE images
                            with an`.efi` extension.

1. Copy the `bootaa64.efi` file from the
                                        efimountedbin folder
                                        /EFI/BOOT and the
                                        `uki.efi` file from the
                                        /EFI/Linux folder to the
                                        images folder on your Linux
                                    machine.
        2. Sign the
                                    images:

                cd <workspace>/imagesCopy to clipboard

                sudo sbsign --key <workspace>/keys/db.key --cert <workspace>/keys/db.crt bootaa64.efi --output <workspace>/bootaa64.efiCopy to clipboard

                sudo sbsign --key <workspace>/keys/db.key --cert <workspace>/keys/db.crt uki.efi --output <workspace>/uki.efiCopy to clipboard
    2. Sign `dtb` image:
        All images authenticated by UEFI secure
                            boot are regular APIs and typically in the PE format. The signature
                            header and size are appended to the existing PE header, and signature is
                            appended at the end of the signed file.

        However, when images in
                            non-PE formats require UEFI secure boot authentication, the absence of
                            the PE header and its magic number to recognize the image format fail.
                            As a result, it is not possible to use standard tools and paths for
                            image verification.

        Currently, among the list of images that UEFI
                            secure boot verifies, only the dtb files are in non-PE format images. As
                            an alternative to sbsign tool, you can use the OpenSSL cms command to
                            generate signature files for signing images in non-PE
                            format.

Follow these steps for signing non-EFI images:
        1. To sign the dtb file and signature file, run the following
                                    command:

                openssl cms -sign -inkey < .key file > -signer < .crt file > -binary -in <input dtb file>--out < Output .dtb.sig file > -outform DERCopy to clipboard
        2. To sign the image, run the following
                                    command:

                cd <workspace>/imagesCopy to clipboard

                sudo openssl cms -sign -inkey <workspace>/keys/db.key -signer <workspace>/keys/db.crt -binary -in qcm6490-idp.dtb --out qcm6490-idp.sig -outform DERCopy to clipboard
7. Copy the signed `uki` and `bootaa64` images back to
                their respective folder locations (/EFI/BOOT and /EFI/Linux)
                within the efimountedbin directory.
8. Copy the signed `qcm6490-idp.sig` file to the
                    /dtb folder of the efimountedbin
                directory.
9. Configure the wait time in systemd-boot:
    1. Open and edit the `loader.conf` file at
                            /loader/loader.conf with sudo
                        access:

            sudo vi loader.confCopy to clipboard
    2. Add the line `timeout 2` to set the boot menu timeout and
                        save the file.
10. To unmount the EFI binary to retrieve the latest `efi.bin` file,
                execute the
                command:

        sudo umount efimountedbinCopy to clipboard
11. Securely place the signed images and keys in the EFI partition on target.
Bring
                    the device into the Fastboot mode and flash the latest `efi.bin`
                    file with the fastboot
                    command:

        fastboot flash efi <efi binary location>Copy to clipboard

**Parent Topic:** [Enable UEFI secure boot](https://docs.qualcomm.com/doc/80-70014-11/topic/enable-uefi-secure-boot.html)

Last Published: Aug 06, 2024

[Previous Topic
Generate key and certificate](https://docs.qualcomm.com/bundle/publicresource/80-70014-11/topics/generate-key-and-certificate.md) [Next Topic
Enable UEFI secure boot from systemd-boot menu](https://docs.qualcomm.com/bundle/publicresource/80-70014-11/topics/enable-uefi-secure-boot-from-systemd-boot-menu.md)