Raspberry Pi has upgraded its secure boot provisioning software, rpi-sb-provisioner, making it easier to provision more complex operating system images and deploy Raspberry Pi Connect at scale.

Version 2.3 of rpi-sb-provisioner makes use of the new device identity support in Raspberry Pi Connect for Organisations, allowing you to automatically give your devices an immutable identity and tie them to your Raspberry Pi Connect for Organisations account.

Previous releases of rpi-sb-provisioner assumed that you had created a traditional Raspberry Pi OS–derived image using pi-gen.

After the initial release, however, users said they wanted to provision more complex layouts or build images in a more ergonomic way.

To address both needs, Pi introduced image description provisioning (IDP) in rpi-image-gen, which is now integrated into version 2.3 of rpi-sb-provisioner.

Image description provisioning transforms rpi-sb-provisioner from a fixed-function provisioner into a fully programmable provisioning system, enabling you to specify a wide range of partition layouts, types, and other attributes.

IDP can also be used to provision operating systems that weren’t created with rpi-image-gen: if you can describe it, you can provision it.

The rpi-sb-provisioner 2.3 OS image selection view; IDP artefacts have extended metadata to help you pick the correct image and confirm your assumptions ahead of production

With the release of rpi-fw-crypto, Raspberry Pi devices now have a mechanism for using asymmetric cryptography without unduly exposing the device-unique private key written by rpi-sb-provisioner. We make use of this function in two major areas:

1. On the provisioning server, to encrypt and bind the signing material (a PEM file or HSM PIN) to the provisioning server.
2. On the provisioned devices, as part of the material used to calculate a full disk encryption key, either through a supplied pre-boot authentication environment or one you build with rpi-image-gen.

An example key added to the rpi-sb-provisioner 2.3 secure boot key selection options; the key hash and encryption state are shown so that you can confirm which key you’re writing to the devices.

See all our Raspberry Pi content.