tegra-uefi-keys-dtb: automates UEFI device tree file generation

[gabrielssanches]

Generates UEFI device tree files instead of doing outside of yocto.
This covers generation of UefiDefaultSecurityKeys.dts/dtbo
The minimal set of keys and certs is:

TEGRA_UEFI_PK_CERT
TEGRA_UEFI_KEK_1_CERT
TEGRA_UEFI_DB_1_KEY
TEGRA_UEFI_DB_1_CERT

tegra-flashtools-native: installs gen_uefi_keys_dts.sh

[gabrielssanches]

There is an issue to be solved still.

it depends on cert-to-efi-sig-list which is provided by efitools
I brought https://github.com/Wind-River/meta-secure-core locally to cover that, but had to include 3 additional layers:

meta-perl
meta-secure-core-common
meta-efi-secure-boot
meta-signing-key

it is a bit too much in my opinion, but the alternative is to roll a meta-tegra efitool recipe (may be just focused on building cert-to-efi-sig-list)

let me know what are your thoughts on this

[madisongh]

I'd prefer it if the existing recipe retains its current behavior by default, so as not to break builds that use the bbappend approach.

While automating the DTS file generation isn't a bad idea, I'm a bit worried that having a recipe do that generation would make it too easy to expose secrets, since users are apt to just check in the db_1.key and db_1.cert files into git as part of a layer.

As for the missing tool, we could add a recipe to build just the needed tool for this purpose.

[gabrielssanches]

sounds like the right way to do it. I am on paternity leave until March 2026 😅 so it will have to wait