=pod

=head1 NAME

cst - Code Signing Tool for generating binary CSF files for NXP secure boot

=head1 SYNOPSIS

B<cst> B<--output> I<file> B<--input> I<file>
[B<--cert> I<cert.pem>] [B<--backend> I<ssl|pkcs11>]
[B<--verbose>]

B<cst> B<--license>|B<--version>|B<--help>

=head1 NOTE

This manpage is a short description of NXP B<cst>.
For a detailed discussion refer to the Code Signing Tool User Guide UG10106, section 5.
The user guide can be obtained from www.nxp.com and is excluded from Debian for copyright reasons.

=head1 DESCRIPTION

B<cst> (Code Signing Tool) is used to generate a binary Command Sequence File (CSF) required by the HAB or AHAB secure boot mechanisms on NXP i.MX processors.
The CSF contains the authentication commands and signature data used to verify signed boot images during the secure boot process.

The tool processes a plain-text CSF description file and produces a binary CSF that can be appended to or embedded in a boot image.
Optionally, a certificate can be provided to encrypt the Data Encryption Key (DEK).

The tool will load general settings and those related to discover PKCS#11 module from the system wide OpenSSL configuration file.

=head1 OPTIONS

=over 4

=item B<-o>, B<--output> I<file>

The output binary CSF file to generate.

=item B<-i>, B<--input> I<file>

The input CSF description text file.

=item B<-c>, B<--cert> I<cert.pem>

Public key certificate to encrypt the DEK (optional).

=item B<-b>, B<--backend> I<backend>

Optional.
Backend for key handling. Default is B<ssl> (local filesystem).
B<pkcs11> uses a PKCS#11-compatible keystore.

=item B<-g>, B<--verbose>

Enable verbose output.

=item B<-l>, B<--license>

Print license information and exit.

=item B<-v>, B<--version>

Print the tool version and exit.

=item B<-h>, B<--help>

Display a brief help message.

=back

=head1 EXAMPLES

=over 4

=item Generate binary CSF from a text CSF file:

  cst -o out_csf.bin -i hab4.csf

=item Encrypt DEK with a certificate:

  cst -o out_csf.bin -c cert.pem -i hab4.csf

=back

=head1 SEE ALSO

L<srktool(1)>, L<hab_csf_parser(1)>, L<config(5ssl)>

=cut
