== rock-5b-secureboot.img from rock-5b_UEFI_Release_824e6c12168a+harma.enforced.ra186830a.img (6446592 bytes, zero-padded to 0x7C0000)
device        rock-5b
edk2-rk3588   824e6c12168a51cf72470fb43da60642e835198f
org           harma
secure-boot   enabled
recipe        a186830a
tf-a          51d8794cc2b52e8df842ab2d2b6e1326a80da735 (+ scripts/firmware/tfa-patches)
# submodules
  +51d8794cc2b52e8df842ab2d2b6e1326a80da735 arm-trusted-firmware (v2.15.0-796-g51d8794cc)
  +1826bba6fb1c8c0b6d845f8308590dcfd1f7f859 devicetree/mainline/upstream (v7.2-dts)
  +2970e5699ba6267f3384ffab20f96647578aebc8 edk2 (edk2-stable202608)
  +7ac12d81e02b323bffdf1ef3c188ea33c2185c91 edk2-non-osi (heads/master)
  +2db572db2fead29fbb4b622b0ea954b2f2f93a62 edk2-platforms (heads/master)
  +3e288fe814e059dd06833495f845cab04ac20a5c misc/rkbin (heads/master)
# inputs (sha256)
  keys/a1117f516a32cefcba3f2d1ace10a87972fd6bbe8fe0d0b996e09e65d802a503  ms_kek.cer
  keys/48e99b991f57fc52f76149599bff0a58c47154229b9f8d603ac40d3500248507  ms_uefi_ca.cer
  keys/c00260dea0936e899b4803ab67c1eacfe5e4f9286e526258fbad8e33f3960838  org_db.cer
  keys/900cf1ef6a2c6e7d6dd8885bff6c003fde55ee6bebf025325f856f2d73e59ac0  org_kek.cer
  keys/5d97be7342924783b331630b4d36f47e05825ad46c3290b64821d44550ec6b75  org_pk.cer
  8eb05757435dc6f866d0dca68dde1d6295108ff1ea09dce1271333da200b4a80  edk2-rockchip/Platform/Radxa/Drivers/LogoDxe/Logo.bmp
# patches
  9950df0fa678c0119c1544ae6714c93d6e9c0c6cd748283ec78d9118a816cbdd  0001-fit-drop-never-executed-optee.patch
  be747a990b5d34b34ae2cc01be83c5a257f3c02e3c3bb8387ad02fb8b141d143  0002-fit-bl31-rw-segment-at-mainline-address.patch
  404ea29f353524fb622ab1831d9fc7e8784048757fe8266fad4cbce102f138e8  0003-port-to-edk2-stable202608.patch
  5b0938fccd54e7c45747eac5e939c19f37d427f7c1d4eb4e4b63303ad21ebdc2  0004-secure-boot-enroll-default-keys.patch
  b7a53b8b1e81feaf1c3c399caa3f687eed642fa81b3154123d0ea24746254184  0001-feat-rk3588-add-doorbell-interrupt-support-to-SCMI.patch
  0d120c4beaad2088349b6cdc631eca7e5d66f160a78e5fbbbcb918082169ab39  0002-feat-scmi-add-voltage-domain-support.patch
  ddb1db900c51a4fd914716e9b3697ebeb7f1d06efc70375547bb2fdd7c147bcb  0003-feat-rockchip-support-SCMI-voltage-domain.patch
  03f235112b212719cb3bfc3aeb34b7f3eebc09b7585528a52bc71e892e49d15d  0004-feat-rockchip-add-SPI-driver.patch
  88e20932fc3a5d2b98e239b87d47251c9ff5bccbdcda62fa9c3533b69926bbf7  0005-feat-rockchip-add-RK806-PMIC-driver.patch
  5d213093f97d84a6ab0edeee194f65257502b9a692854a8d6accfdbae335687e  0006-feat-rk3588-initial-support-for-SCMI-voltage-domain.patch
  8b083ac5eb5f352d018e2e44df0e3f8189cc6a16e59e150b227cf2bfccbfd5e9  0007-feat-rk3588-add-SCMI_CCLK_EMMC.patch
  1f50d6dce43dc2bb45f4532d5f0a2899496816be5072a0020ba441bd4b06b9e3  0008-feat-rk3588-introduce-SD-MMC-Control-Service.patch
  c4e4cf827a15f72e92dcd64255637f973134d90daa504c1e27ceed34859cb28d  0009-feat-rk3588-add-TRNG-support.patch
# BL31 segments
  126976  bl31_0x00040000.bin
  9193  bl31_0x0005f000.bin
  0  bl31_0x000f0000.bin
  8192  bl31_0xff100000.bin
# edk2 flags
  -D SECURE_BOOT_ENABLE=TRUE -D DEFAULT_KEYS=TRUE -D PK_DEFAULT_FILE=keys/org_pk.cer -D KEK_DEFAULT_FILE1=keys/org_kek.cer -D DB_DEFAULT_FILE1=keys/org_db.cer -D KEK_DEFAULT_FILE2=keys/ms_kek.cer -D DB_DEFAULT_FILE2=keys/ms_uefi_ca.cer -D SECURE_BOOT_ENROLL_DEFAULTS=TRUE -D RK_X86_EMULATOR_ENABLE=FALSE -D RK_AMD_GOP_ENABLE=FALSE
# Secure Boot: SECUREBOOT_TRUST=microsoft
  subject=CN=harmacolindor.com Secure Boot PK
  sha256 Fingerprint=5D:97:BE:73:42:92:47:83:B3:31:63:0B:4D:36:F4:7E:05:82:5A:D4:6C:32:90:B6:48:21:D4:45:50:EC:6B:75
  subject=CN=harmacolindor.com Secure Boot KEK
  sha256 Fingerprint=90:0C:F1:EF:6A:2C:6E:7D:6D:D8:88:5B:FF:6C:00:3F:DE:55:EE:6B:EB:F0:25:32:5F:85:6F:2D:73:E5:9A:C0
  subject=CN=Scutarius Secure Boot signing key
  sha256 Fingerprint=C0:02:60:DE:A0:93:6E:89:9B:48:03:AB:67:C1:EA:CF:E5:E4:F9:28:6E:52:62:58:FB:AD:8E:33:F3:96:08:38
# image
  2d48d155a5a53a3f55d2fcac3c9e075abe42004ddeed4316281dd122ad15ee79  rock-5b_UEFI_Release_824e6c12168a+harma.enforced.ra186830a.img
  101789d7fd140a39766d0b692dccecbb040872eb582bb2a7c04d24ee83d705c7  rock-5b-secureboot.img (padded, as shipped)

== rock-5b-nosecureboot.img from rock-5b_UEFI_Release_824e6c12168a+harma.not-enforced.rb27b4697.img (6446592 bytes, zero-padded to 0x7C0000)
device        rock-5b
edk2-rk3588   824e6c12168a51cf72470fb43da60642e835198f
org           harma
secure-boot   disabled
recipe        b27b4697
tf-a          51d8794cc2b52e8df842ab2d2b6e1326a80da735 (+ scripts/firmware/tfa-patches)
# submodules
  +51d8794cc2b52e8df842ab2d2b6e1326a80da735 arm-trusted-firmware (v2.15.0-796-g51d8794cc)
  +1826bba6fb1c8c0b6d845f8308590dcfd1f7f859 devicetree/mainline/upstream (v7.2-dts)
  +2970e5699ba6267f3384ffab20f96647578aebc8 edk2 (edk2-stable202608)
  +7ac12d81e02b323bffdf1ef3c188ea33c2185c91 edk2-non-osi (heads/master)
  +2db572db2fead29fbb4b622b0ea954b2f2f93a62 edk2-platforms (heads/master)
  +3e288fe814e059dd06833495f845cab04ac20a5c misc/rkbin (heads/master)
# inputs (sha256)
  keys/a1117f516a32cefcba3f2d1ace10a87972fd6bbe8fe0d0b996e09e65d802a503  ms_kek.cer
  keys/48e99b991f57fc52f76149599bff0a58c47154229b9f8d603ac40d3500248507  ms_uefi_ca.cer
  keys/c00260dea0936e899b4803ab67c1eacfe5e4f9286e526258fbad8e33f3960838  org_db.cer
  keys/900cf1ef6a2c6e7d6dd8885bff6c003fde55ee6bebf025325f856f2d73e59ac0  org_kek.cer
  keys/5d97be7342924783b331630b4d36f47e05825ad46c3290b64821d44550ec6b75  org_pk.cer
  8eb05757435dc6f866d0dca68dde1d6295108ff1ea09dce1271333da200b4a80  edk2-rockchip/Platform/Radxa/Drivers/LogoDxe/Logo.bmp
# patches
  9950df0fa678c0119c1544ae6714c93d6e9c0c6cd748283ec78d9118a816cbdd  0001-fit-drop-never-executed-optee.patch
  be747a990b5d34b34ae2cc01be83c5a257f3c02e3c3bb8387ad02fb8b141d143  0002-fit-bl31-rw-segment-at-mainline-address.patch
  404ea29f353524fb622ab1831d9fc7e8784048757fe8266fad4cbce102f138e8  0003-port-to-edk2-stable202608.patch
  5b0938fccd54e7c45747eac5e939c19f37d427f7c1d4eb4e4b63303ad21ebdc2  0004-secure-boot-enroll-default-keys.patch
  b7a53b8b1e81feaf1c3c399caa3f687eed642fa81b3154123d0ea24746254184  0001-feat-rk3588-add-doorbell-interrupt-support-to-SCMI.patch
  0d120c4beaad2088349b6cdc631eca7e5d66f160a78e5fbbbcb918082169ab39  0002-feat-scmi-add-voltage-domain-support.patch
  ddb1db900c51a4fd914716e9b3697ebeb7f1d06efc70375547bb2fdd7c147bcb  0003-feat-rockchip-support-SCMI-voltage-domain.patch
  03f235112b212719cb3bfc3aeb34b7f3eebc09b7585528a52bc71e892e49d15d  0004-feat-rockchip-add-SPI-driver.patch
  88e20932fc3a5d2b98e239b87d47251c9ff5bccbdcda62fa9c3533b69926bbf7  0005-feat-rockchip-add-RK806-PMIC-driver.patch
  5d213093f97d84a6ab0edeee194f65257502b9a692854a8d6accfdbae335687e  0006-feat-rk3588-initial-support-for-SCMI-voltage-domain.patch
  8b083ac5eb5f352d018e2e44df0e3f8189cc6a16e59e150b227cf2bfccbfd5e9  0007-feat-rk3588-add-SCMI_CCLK_EMMC.patch
  1f50d6dce43dc2bb45f4532d5f0a2899496816be5072a0020ba441bd4b06b9e3  0008-feat-rk3588-introduce-SD-MMC-Control-Service.patch
  c4e4cf827a15f72e92dcd64255637f973134d90daa504c1e27ceed34859cb28d  0009-feat-rk3588-add-TRNG-support.patch
# BL31 segments
  126976  bl31_0x00040000.bin
  9193  bl31_0x0005f000.bin
  0  bl31_0x000f0000.bin
  8192  bl31_0xff100000.bin
# edk2 flags
  -D SECURE_BOOT_ENABLE=TRUE -D DEFAULT_KEYS=TRUE -D PK_DEFAULT_FILE=keys/org_pk.cer -D KEK_DEFAULT_FILE1=keys/org_kek.cer -D DB_DEFAULT_FILE1=keys/org_db.cer -D KEK_DEFAULT_FILE2=keys/ms_kek.cer -D DB_DEFAULT_FILE2=keys/ms_uefi_ca.cer -D SECURE_BOOT_ENROLL_DEFAULTS=FALSE -D RK_X86_EMULATOR_ENABLE=FALSE -D RK_AMD_GOP_ENABLE=FALSE
# Secure Boot: SECUREBOOT_TRUST=microsoft
  subject=CN=harmacolindor.com Secure Boot PK
  sha256 Fingerprint=5D:97:BE:73:42:92:47:83:B3:31:63:0B:4D:36:F4:7E:05:82:5A:D4:6C:32:90:B6:48:21:D4:45:50:EC:6B:75
  subject=CN=harmacolindor.com Secure Boot KEK
  sha256 Fingerprint=90:0C:F1:EF:6A:2C:6E:7D:6D:D8:88:5B:FF:6C:00:3F:DE:55:EE:6B:EB:F0:25:32:5F:85:6F:2D:73:E5:9A:C0
  subject=CN=Scutarius Secure Boot signing key
  sha256 Fingerprint=C0:02:60:DE:A0:93:6E:89:9B:48:03:AB:67:C1:EA:CF:E5:E4:F9:28:6E:52:62:58:FB:AD:8E:33:F3:96:08:38
# image
  09bdac863a6182686686fbb2ede669102c4be33809c624154a1e8a3a2efd99df  rock-5b_UEFI_Release_824e6c12168a+harma.not-enforced.rb27b4697.img
  69ffe6e4cb6dd826fca232558f97699e5070572674763872750bbafe7a3db4a9  rock-5b-nosecureboot.img (padded, as shipped)

