Hey Chandan, Thanks for bringing this up. I chatted with Scott about this. Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added. Neither of these points are properly documented in docs.starlingx.io ☹ I can’t remember the details of why we are not doing this. I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key. Can you raise a starlingx launchpad ( https://launchpad.net/starlingx ) to address the docs.starlingx.io documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ? Greg. From: Scott Little <scott.little@windriver.com> Sent: Wednesday, June 29, 2022 10:42 AM To: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . On 2022-06-02 13:12, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”. However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso. I believe, the public key provided with iso is not correct. Can you please confirm ? Regards, Chandan Kumar. _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__http:/lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss__;!!AjveYdw8EvQ!e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg$> Thanks for the report. I'll look into it Scott Little