Open Source Summit + Embedded Linux Conference North America 2026

Secure boot is becoming essential for more embedded Linux systems, yet secure firmware signing at scale remains challenging. Traditional approaches often rely on manual, locally managed scripts and cryptographic keys, leading to increased security risks from development to production environments. This presentation demonstrates a practical approach to secure boot image creation using U-Boot's Binman tool integrated with Hardware Security Modules (HSMs) for cryptographic signing. We examine how Binman assembles multi-stage boot images and delegates signing to HSMs, protecting private keys while enabling automated builds. We will also explore how Binman's signing workflow can be adapted to support various HSM deployment models. Attendees will understand how image signing with Binman establishes a secure boot chain of trust, why HSM-backed signing is critical for production systems, and how open-source tools can be combined with security best practices to create more robust and scalable firmware signing workflows. The goal is to help the broader open-source ecosystem adopt more standardized and secure practices for firmware image creation and signing suitable for production deployment