7. SquashFS RootFS Signing and Kernel Verification

7.1. Overall Goal

• Purpose： Deviceon mtdblock6 etc.DeviceNode of SquashFS rootfs（Partition withBoard-levelis ） ，Kernelin before SignatureVerification，Failure 。

• ImplementationMethod： mksquashfs ofImage SHA256 and RSA Signature，and DefinitionSignature ；Kernel before Signature Verification。

7.2. Useand

Usecan is：

1. menuconfig->Kernel options->Enable kernel secure boot。

2. Execute build_all。

3. BurningGenerateofImage，will install/.../rootfs.spinor （Path Board Variant ）Write ROOTFS Partition。

Optional： check_rootfs_sig.sh Confirm rootfs alreadySignature（sig_len>0）。 Certificate need linux_5.10/certs/cert.pem and -c / -k 。

• Signature verification succeeds： VFS: Mounted root (squashfs filesystem) readonly on device 31:6. ， after /sbin/init normal startup。

• error -126：If SquashFS raw signature requires cert with 'SquashFS Root Signing' ， get_squashfs_x509_key() is NULL。Through fallback Modifyafter， Certificate（If “Internet Widgits Pty Ltd”） SquashFS key， can 。

• error -129 （ PKCS#7 Path）：If Message digest doesn't match or error -129， isDeviceonbefore bytes_used BytesandSignature payload not ； beforealready Definition raw ， PKCS#7 。

7.3. Related Files

Purpose	Path（ ）
Private Key（Signature）	ramdisk/keys/test_reeos.key
Certificate（Signature Verification）	linux_5.10/certs/cert.pem
Signing Script	build/scripts/append_squashfs_sig.py
Script	build/scripts/check_rootfs_sig.sh
KernelSignature Verification	linux_5.10/fs/squashfs/verification.c
CertificateLoad	linux_5.10/certs/system_keyring.c
SquashFS key Interface	linux_5.10/security/keys/key.c

CertificateThrough CONFIG_SYSTEM_TRUSTED_KEYS Kernel； on Private Key rootfs Signature。