.. _os-nethsm-signing:

##############
NetHSM Signing
##############

``meta-orchestraos-nitrokey-nethsm`` integrates Nitrokey NetHSM with the
OrchestraOS image-signing workflow. It enables signing with private keys held
by an external HSM, including i.MX boot artifacts and RAUC update bundles.
The integration operates in the build environment.

The layer contains:

- The NetHSM PKCS#11 module and configuration template.
- OpenSSL, libp11, p11-kit, and GnuTLS integration for signing tools.
- Signing-task integration for i.MX bootloader, kernel, and boot-container
  artifacts, including the AHAB SPSDK provider dependency.
- Integration with OrchestraOS image recipes for RAUC bundle signing.
- A native diagnostic tool for inspecting available HSM tokens and objects.

The HSM supplies signing operations; the device continues to verify the
resulting boot artifacts and update bundles using its provisioned trust
material. Signing and device enrollment remain separate activities.

Connection setup, authentication, key selection, build instructions, and
diagnostics are maintained in ``README.md`` in the
``meta-orchestraos-nitrokey-nethsm`` repository. The layer is available under a
separate commercial license; contact sales@cthings.co for access and licensing
information.