How to integrate your signing server with your CI/CD

🚧 Documentation is under development

The RidgeRun Platform Security Manual guide is currently under active development. Some sections may be incomplete or change without notice.

Questions? Contact RidgeRun or email to support@ridgerun.com.

Follow us on:

Share This Page

Facebook Twitter LinkedIn WhatsApp Email Copy Link

Close

Send Email Using

Gmail (Web) Thunderbird (default mail app)

Close

RidgeRun Platform Security Manual

< >

RidgeRun Platform Security Manual from RidgeRun

Contents Pin

• Introduction
  • Why Do I Need To Secure My Project?
  • What Do I Need Before Securing My Project?
  • When Is My Project Secure Enough?
  • How Can RidgeRun Help?
• General Security Concepts
  • Root Of Trust
  • Secure Boot
  • Trusted Execution Environment (TEE)
  • Trusted Platform Module (TPM)
  • Measured Boot and Integrity Measurement Architecture (IMA)
  • Disk Encryption
  • Over-the-Air updates (OTA)
  • Kiosk Modes
• Getting Started
  • Platform Support
  • NVIDIA Jetson
    • JetPack Build Process
      • Security Flow
      • Secure Boot
      • Trusted Execution Environment (TEE)
      • Disk Encryption
      • Over-the-Air
        • Main Providers
        • NVIDIA Jetson - Mender
        • NVIDIA Jetson - RAUC
          • Bring Up and Yocto Integration
          • Update Flow and Custom Bootloader
          • Advanced Topics and Troubleshooting
      • Trusted Platform Module (TPM)
      • Kiosk Modes
      • Bringing NVIDIA Jetson Secure Boot To Production
        • Integrate your NVIDIA flashing scripts with HSM
        • How to integrate your signing server with CI/CD
        • Setting up your signing server
        • Integrating your signing server with Yocto
    • Yocto Build Process
      • Secure Boot
      • Trusted Execution Environment (TEE)
      • Disk Encryption
  • NXP i.MX95
    • Security Flow
    • Yocto Build Process
      • Secure Boot
      • Disk Encryption
      • Over-the-Air (OTA)
      • Antirollback
• Contact Us
• Sponsor your Favorite Feature

How to integrate your signing server with your CI/CD

The previous page covers how to integrate NVIDIA flashing scripts with an HSM. This page continues the production Secure Boot workflow by describing how the signing process fits into CI/CD.

To take Secure Boot signing to production, the signing process must be integrated with the CI/CD workflow. In a typical production setup, CI/CD is responsible for building Yocto images and unsigned boot artifacts, while the signing server performs signing operations independently.

The boundary between both systems is a REST API. CI/CD sends unsigned artifacts to the API, the signing server processes the request using protected keys and vendor signing tools, and the signed outputs are returned to the pipeline.

CI/CD pipeline sending unsigned artifacts through a REST API to an isolated signing server, which returns signed outputs without exposing private keys to the build environment

Two steps to production

To move this architecture from concept to production, follow the next two guides in order:

1. Launch your own signing server: prepare a local or hosted signing service, connect it to the required keys and L4T tools, expose the REST API, and verify that it is functional.
2. Connect Yocto to the signing server: customize meta-tegra using bbclasses and signing hooks so Yocto can send signing requests from CI/CD.

RidgeRun Platform Security Manual

Back to top ↑ < >