This repository defines the configuration for the OpenTitan Earlgrey Open-Market SKU.
This repository is meant to be linked into the upstream opentitan repository (the earlgrey_1.0.0 branch) by overriding the ot_provisioning_exts module.
The file skus/cfg.bzl contains the top-level configuration data for this repository.
The opentitan repository will use this configuration to configure the provisioning firmware and test targets for the SKUs defined in cfg.bzl.
OpenTitan is administered by lowRISC CIC as a collaborative project to produce high quality, open IP for instantiation as a full-featured product. See the OpenTitan site and OpenTitan docs for more information about the project.
The main usage of this repository will come through automated Github workflows - as such, it is not anticipated that much local development will be necessary. If this is needed, most required tooling is packaged by Bazel. The recommended development flow is to install Bazelisk, which will automatically manage bazel versions for you.
Since this repository hooks into OpenTitan, you may need to install many of the dependencies that are required by OpenTitan if you want to manually run the automated flows. See OpenTitan's "Getting started" documentation for more information.
git clone https://github.com/lowRISC/opentitan
git clone https://github.com/lowRISC/ot-sku
# Here we capture the repeated override arg in an environment variable.
# You might want to consider using this in a .bazelrc file instead.
export BAZEL_OVERRIDE_ARGS=--override_module=ot_provisioning_exts=${PWD}/ot-sku
cd opentitan
git fetch origin earlgrey_1.0.0
git checkout earlgrey_1.0.0
# Now you can perform your builds or tests
bazelisk test ${BAZEL_OVERRIDE_ARGS} --test_output=streamed //sw/host/provisioning/orchestrator/tests:e2e_multistage_ot00_staging_hyper310_test
bazelisk build ${BAZEL_OVERRIDE_ARGS} @provisioning_exts//open/rom_ext:rom_ext_dice_x509_prod_slot_virtualGitHub releases are used to automate the majority of the signing flows.
For more detailed documentation covering how to create a release, see doc/create_release.md.
For developers that are making changes to or maintaining the release flow, see some additional developer documentation in doc/create_release_dev.md.
For the signing operation, you will need to run hsmtool.
At the time of writing, this can be acquired from the earlgrey_1.0.0 branch of OpenTitan by running the following from your local copy:
bazelisk build //sw/host/hsmtoolYou can either run this directly with bazelisk run, or use bazelisk cquery to find the output binary and copy it elsewhere.
A separate version of hsmtool is also maintained in the opentitan-signing-infra repository.
To acquire hsmtool from this repository, you can run:
bazelisk build //hsmtoolIn the future, it is planned to migrate all OpenTitan implementations to use this separate repository, and the above will be deprecated.
This repository is currently still being setup, and as such SoftHSMv2 is being used as a software HSM to test the release and signing flows. If you are intending on using these testing flows, you can find more relevant documentation about configuring SoftHSM here.
Unless otherwise noted, everything in this repository is covered by the Apache License, Version 2.0 (see LICENSES/Apache-2.0.txt for the full text).