diff mbox series

[v2,5/5] doc/user_manual: describe module signer and certificate provider configuration

Message ID 20250416171709.742191-6-gokhan.cetin@siemens.com
State Accepted, archived
Headers show
Series Structure module signing dependencies and providers | expand

Commit Message

Gokhan Cetin April 16, 2025, 5:17 p.m. UTC 
Mentions how `KERNEL_MODULE_SIGNATURES` can be used and how to manage the dependencies.

Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com>
---
 doc/user_manual.md | 8 ++++++++
 1 file changed, 8 insertions(+)
diff mbox series

Patch

diff --git a/doc/user_manual.md b/doc/user_manual.md
index d8e5c33e..627dacb7 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -1162,9 +1162,17 @@  To provide a signer script that implements your custom signing solution, `SIGNAT
 can be set for the script path within the module recipe together with `SIGNATURE_CERTFILE` to define the public
 certificate path of the signer.
 
+In order to choose between different signing solutions, signer recipes should provide the `module-signer`
+target and package while certificate provider recipes should provide the `secure-boot-secrets` as target and package
+to meet build dependencies. This way, desired signers and certificates can be configured using `PREFERRED_PROVIDER`.
+
 Please see how `module-signer-example` hook generates a detached signature for the kernel module implemented in
 `example-module-signedwith` recipe.
 
+You can enable build-wide kernel module signing by defining `KERNEL_MODULE_SIGNATURES = "1"` globally,
+in this case, `pkg.signwith` build profile is added by default in addition to
+`module-signer` and `secure-boot-secrets` target and package dependencies to the kernel module recipes.
+
 ### Cross Support for Imagers
 
 If `ISAR_CROSS_COMPILE = "1"`, the imager and optional compression tasks