Hi Igor, Thank you for the patch.
On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <[email protected]> wrote: > When a device already runs OP-TEE, its root-of-trust key should live in the > same secure, RPMB-backed storage that already holds the AVB rollback > indexes and lock state, so it is provisioned per device and protected by > the secure world -- not shipped inside the bootloader image. > > Let AVB fetch the trusted digest from the OP-TEE AVB TA. It reuses the > existing persistent-value interface, so no change to the TA is required, > and a missing value fails closed. > > Signed-off-by: Igor Opaniuk <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> > ---
