NetHSM Signing

meta-orchestraos-nitrokey-nethsm integrates Nitrokey NetHSM with the OrchestraOS image-signing workflow. It enables signing with private keys held by an external HSM, including i.MX boot artifacts and RAUC update bundles. The integration operates in the build environment.

The layer contains:

• The NetHSM PKCS#11 module and configuration template.

• OpenSSL, libp11, p11-kit, and GnuTLS integration for signing tools.

• Signing-task integration for i.MX bootloader, kernel, and boot-container artifacts, including the AHAB SPSDK provider dependency.

• Integration with OrchestraOS image recipes for RAUC bundle signing.

• A native diagnostic tool for inspecting available HSM tokens and objects.

The HSM supplies signing operations; the device continues to verify the resulting boot artifacts and update bundles using its provisioned trust material. Signing and device enrollment remain separate activities.

Connection setup, authentication, key selection, build instructions, and diagnostics are maintained in README.md in the meta-orchestraos-nitrokey-nethsm repository. The layer is available under a separate commercial license; contact sales@cthings.co for access and licensing information.