Open Source Summit Europe 2024

More and more applications of embedded linux systems require them to ensure that only trusted software is started on the device. This means that verified boot procedures need to be employed to verify the software running on the device. This talk will highlight the necesssary components to cryptographically verify the bootloader, kernel and filesystem. It will also show how these components can be integrated using the OpenEmbedded build system. Bootloader verification will be covered by providing examples to use the signing.bbclass in Yocto in conjunction with the NXP CST tool to sign a bootloader, kernel verification is covered by a to be upstreamed fitimage class and filesystem verification will be shown with a dm-verity class example for Yocto. Additionally the talk will highlight common pitfalls when deploying locked down embedded systems encountered during project work. We will also cover the case of using GPLv3 licenses on locked down devices.