Advanced users • Secure boot with a/b partitions

Hi,

i've set up a system where my pi-gen build generates an image with 3 partitions, which i use in an a/b setup:
- fat32 containing autoboot
- fat 32 containing a signed boot.img
- ext4 for the root partition

When the CM4 device is first created i also create an extended partition with 3 more partitions in there, the ones for boot.img and root and a shared data partition. So 7 partitions in total, of which 1 extended.

My problem right now is that when i write the image to the B partition set i get into problems with cmdline.txt in boot.img. On a non encrypted system i go in there and change the root=PARTUUID=xxxxx-03 to xxxxx-06 to use the correct root partition when installing. When using the signed boot.img this is not possible.

One of the options i'm seeing is including two boot partitions in each build, one for partition 02 and one for partition 05, and when i'm writing the update on the other partition pick the correct image to write, but it seems wasteful to have a 500mb partition duplicated for 1 byte that is different.

Has anyone done something like this before and found a better way than including two partitions with boot.img?

Thanks!!!

Statistics: Posted by nachte — Mon Aug 19, 2024 4:24 pm — Replies 0 — Views 36

---