Best way to add unique certificates to each device during provisioning?

[PixPStudio]

Hello,

I need to add unique certificates per device for each device that I am provisioning with secure-boot. If I add my custom script to the rootfs-mounted section and build the image it will run correctly, but only on the first flash.

If I try to flash again the rootfs-mounted script does not attempt to run again.

It works if I rebuild the image... Am I doing something wrong here?

Thanks in advance

2.1.1

[tdewey-rpi]

The problem you're seeing is that the OS image gets cached between provisioning runs to help speed up mass provisioning.

You've got two paths forward:

1. Unset RPI_SB_WORKDIR, and use ephemeral directories. This comes at a provisioning time penalty, so I don't recommend it
2. Make use of Fastboot in the post-flash hook to push files into your device.

That may require the incoming update to Fastboot, but you'd drive it like this:

fastboot oem upload-file /persistent/hashes.json - tells the device where the upload file should be written (/persistent/hashes.json)
fastboot upload hashes.json - sends the staged data to the client, from the local file hashes.json

[PixPStudio]

Thank you for the quick response!

I see some fastboot oem configuration in the post-flash stage in 2.1.1.

Is there a chance this could work in that stage on 2.1.1?

In your previous example where is hashes.json stored on the provisioning device? I have a script that is provisioning just in time certificates so my plan is:

1. flash
2. certs creation (require temp storage)
3. upload with flash boot oem

[tdewey-rpi]

I'm not certain if we've yet packaged the version of fastboot that contains that command - the internal tree is a long way forward of released, while we prepare it for open source use.

[tdewey-rpi]

Apologies - that command is for getting data from device.

This set is for putting data onto the device:

fastboot stage keys.bin
fastboot oem download-file /persistent/keys.bin

[PixPStudio]

Ok thank you!

I think for the time being I will move the workflow to my image as a first boot step. In the future I want to simply do it on the provisioner because it would really improve mass provisioning for me to not have to do a first boot on 100% of devices I build up.

Thanks again for your help!