# Sign images and copy (.auth) key/signed files to EFI partition

Source: [https://docs.qualcomm.com/doc/80-70015-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html](https://docs.qualcomm.com/doc/80-70015-11/topic/sign-images-and-copy-auth-key-signed-files-to-efi-partition.html)

The EFI system partition consists of EFI, loader, and dtb directories with
        information relevant to the EFI when using the systemd-boot.

The procedure provides instructions to:
- Sign various images.
- Copy `(.auth)` key and signed files to EFI partition
                    directory.

- Signed and executable images such as the `bootaa64.efi` file
                            (systemd-boot) are placed in the
                            /EFI/BOOT/ directory and the
                            `uki.efi` file (Linux) image is placed in the
                            `/EFI/Linux/`.

In addition to validating signed images, systemd-bootis used to enroll keys.
- UEFI secure boot keys are placed in a specific directory in
                        /keys for key enrollment. The systemd-boot
                    uses these keys and provisions them in the RPMB or UEFI variable store during
                    UEFI boot time services.

- You can configure the wait time (in seconds) in the systemd-boot loader
                    configuration. Kernel loading is delayed during the wait time, allowing you to
                    review and select available options in the systemd-boot menu.

Device tree files are stored in the /dtb directory. These files are
            used by UEFI during runtime, and the device tree files are initialized. While signing,
                `.sig` files are created and placed in the same directory as these
            files are non- PE images.

| EFI system partition (efi.bin) | EFI system partition (efi.bin) | EFI system partition (efi.bin) |
| --- | --- | --- |
| /EFI | /Loader | /dtb |
| /Boot - bootaa64.efi | loader.conf | <ul class="ul" id="sign_images_and_copy_auth_key_signed_files_to_efi_partition__ul_rvs_gcr_pbc"><br>                                    <li class="li">Chipset DTB file.</li><br><br>                                    <li class="li">Signature file for each DTB file.</li><br><br>                                </ul> |
| /Linux - uki.efi | /keys<br>-/authkeys<br><br><br>PK.auth<br><br><br>KEK.auth<br><br><br>db.auth | <ul class="ul" id="sign_images_and_copy_auth_key_signed_files_to_efi_partition__ul_rvs_gcr_pbc"><br>                                    <li class="li">Chipset DTB file.</li><br><br>                                    <li class="li">Signature file for each DTB file.</li><br><br>                                </ul> |
|  |  |  |

Follow these steps to place the signed images and keys in an EFI partition on a Linux
            host machine:

1. Locate the `efi.bin` file path in the `contents.xml`,
                file to obtain the `efi.bin` file from the meta.
2. Mount the `efi.bin` file into the `<workspace>`
                directory and create an `efimountedbin` directory within the
                    `<workspace>` directory.
3. Mount the `efi.bin`
                file:

        sudo mount efi.bin efimountedbinCopy to clipboard

        cd efimountedbinCopy to clipboard
4. Create an authkeys directory within the
                    &lt;workspace&gt;/efimountedbin/loader/keys directory to
                enroll keys.
5. Select and copy the `.auth` files (`PK.auth`,
                    `KEK.auth`, and `db.auth`) to the authkeys
                directory.

        sudo cp <selected algo PK/KEK/DB auth files from the files location> 
        <workspace>/efimountedbin/loader/keys/authkeys/Copy to clipboard
6. Sign the `bootaa64.efi, uki.efi and dtb` image files with the keys
                and copy to the respective directories in the efimountedbindirectory.
    1. Sign `efi` images:
        The sbsign tool is designed for signing
                            EFI boot images, such as `bootaa64.efior UKI.efi` that
                            follow EFI specifications. This tool, which is used for UEFI secure boot
                            signing is available for download and use on Linux systems. It is
                            important to note that sbsign can only sign PE images with a
                                `.efi` extension.

1. Copy the `bootaa64.efi` file from the
                                        efimountedbin directory
                                        /EFI/BOOT and the
                                        `uki.efi` file from the
                                        /EFI/Linux directory to the
                                        images directory on your Linux
                                    machine.
        2. Sign the
                                    images:

                cd <workspace>/imagesCopy to clipboard

                sudo sbsign --key <workspace>/keys/db.key --cert <workspace>/keys/db.crt bootaa64.efi --output <workspace>/bootaa64.efiCopy to clipboard

                sudo sbsign --key <workspace>/keys/db.key --cert <workspace>/keys/db.crt uki.efi --output <workspace>/uki.efiCopy to clipboard
    2. Sign the `dtb` image:
        All images authenticated by UEFI
                            secure boot are regular APIs and typically in the PE format.
                            The signature header and size are appended to the existing PE
                            header, and the signature is appended at the end of the signed
                            file.

        However, when images in non- PE formats require
                            UEFI secure boot authentication, the absence of the PE header
                            and its magic number to recognize the image format fail. As a result, it
                            is not possible to use standard tools and paths for image
                            verification.

        Currently, among the list of images that UEFI secure
                            boot verifies, only the dtb files are in non- PE
                            format images. As an alternative to the sbsign tool, you can use the
                                `OpenSSL cms` command to generate signature files for
                            signing images in non- PE format.

Follow these steps for
                            signing non-EFI images:
        1. To sign the dtb file and signature file, run the
                                    following
                                    command:

                openssl cms -sign -inkey < .key file > -signer < .crt file > -binary -in <input dtb file>--out < Output .dtb.sig file > -outform DERCopy to clipboard
        2. To sign the image, run the following
                                    command:

                cd <workspace>/imagesCopy to clipboard

                sudo openssl cms -sign -inkey <workspace>/keys/db.key -signer <workspace>/keys/db.crt -binary -in qcm6490-idp.dtb --out qcm6490-idp.sig -outform DERCopy to clipboard
7. Copy the signed `uki` and `bootaa64` images back to
                their respective directory (/EFI/BOOT and /EFI/Linux) within
                the efimountedbin directory.
8. Copy the signed `qcm6490-idp.sig` file to the
                    /dtb directory of the efimountedbin
                directory.
9. Configure the wait time in systemd-boot:
    1. Open and edit the `loader.conf` file at
                            /loader/loader.conf with sudo
                        access:

            sudo vi loader.confCopy to clipboard
    2. Add the line `timeout 2` to set the boot menu timeout and
                        save the file.
10. To unmount the EFI binary to retrieve the latest `efi.bin` file,
                execute the
                command:

        sudo umount efimountedbinCopy to clipboard
11. Securely place the signed images and keys in the EFI partition on target.
Bring
                    the device into the Fastboot mode and flash the latest `efi.bin`
                    file with the fastboot
                    command:

        fastboot flash efi <efi binary location>Copy to clipboard

**Parent Topic:** [Enable UEFI secure boot](https://docs.qualcomm.com/doc/80-70015-11/topic/enable-uefi-secure-boot.html)

Last Published: Oct 14, 2024

[Previous Topic
Generate key and certificate](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/generate-key-and-certificate.md) [Next Topic
Enable UEFI secure boot from systemd-boot menu](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/enable-uefi-secure-boot-from-systemd-boot-menu.md)