Manufacturing data "secure" attribute is empty.

[user8174]

Hello,
At least when re-provisioning a CM5, it appears that the manufacturing data "secure" field is empty. Even though the CM5 is secure boot provisioned.
Tested with rpi-sb-provisioner version 2.3.1.

It looks like this attribute is gathered here:

rpi-sb-provisioner/host-support/manufacturing-data

Line 160 in 75ae69f

SECURE=$(metadata_get "secure")

Assumably by calling the fastboot GetSecure endpoint:
https://github.com/raspberrypi/rpi-fastbootd/blob/main/fastboot/device/variables.cpp#L1385

At a glance, the fastboot GetSecure might not be up to date:

bool GetSecure(FastbootDevice* /* device */, const std::vector<std::string>& /* args */,
               std::string* message) {
    pid_t pid;
    char *arg[] = {"/usr/bin/rpi-otp-private-key", "-c", NULL};
    int ret;
    int wstatus;
    ret = posix_spawnp(&pid, "/usr/bin/rpi-otp-private-key", NULL, NULL, arg, NULL);

Calling the rpi-otp-private-key may not behave as expected since keys can now be locked.

[tdewey-rpi]

Good catch - the 'secure' attribute, that we tried to map over from AOSP, is somewhat problematic anyway - it doesn't capture with enough detail what it actually means.

I'll have a think on what to do with this flag - particularly now we capture items like keys actually being written, etc.