Humanoid Security Platform — Storage & Runtime Integrity Pipeline

EROFS Immutable Filesystem, dm-verity Merkle Tree, and IMA fTPM PCR 10 Extension

Humanoid Security Platform — Storage & Runtime Integrity Pipeline EROFS Immutable Filesystem, dm-verity Merkle Tree, and IMA fTPM PCR 10 Extension L4T Sample Rootfs · Ubuntu Base Filesystem · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Input Source L4T Sample Rootfs Ubuntu Base Filesystem Input Source mkfs.erofs Tool · High-perf Compression · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Build Step mkfs.erofs Tool High-perf Compression Build Step rootfs.erofs · Read-Only Image · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Raw Image rootfs.erofs Read-Only Image Raw Image veritysetup format · Merkle Hash Tree Gen · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Crypto Tool veritysetup format Merkle Hash Tree Gen Crypto Tool Merkle Root Hash · SHA-256 Digest · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Root Digest Merkle Root Hash SHA-256 Digest Root Digest SoftHSM sign_helper · PKCS#11 DmVerityKey · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Zero Plaintext SoftHSM sign_helper PKCS#11 DmVerityKey Zero Plaintext Signed Root Hash · PKCS#7 Signature Block · Offline Build & Signing Phase (DevContainer / SoftHSMv2) · Signature Signed Root Hash PKCS#7 Signature Block Signature Built-in Kernel Keyring · OEM Public X.509 Cert · Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) · Trust Anchor Built-in Kernel Keyring OEM Public X.509 Cert Trust Anchor Kernel dm-verity · Initramfs Hash Check · Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) · Kernel Driver Kernel dm-verity Initramfs Hash Check Kernel Driver Verified /dev/mapper · Read-Only Mounted Root · Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) · Immutable Root Verified /dev/mapper Read-Only Mounted Root Immutable Root IMA Subsystem · Execve Binary Measure · Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) · Runtime Engine IMA Subsystem Execve Binary Measure Runtime Engine fTPM PCR 10 · TPM2_PCR_Extend Log · Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) · Tamper-Proof PCR fTPM PCR 10 TPM2_PCR_Extend Log Tamper-Proof PCR Pack Output Hash Tree Top Hash Digest P7S Sig Verify Key Block Auth Exec Event Extend PCR Offline Build & Signing Phase (DevContainer / SoftHSMv2) Robot Boot & Runtime Execution Phase (QEMU / Real Hardware) Legend Backend Database Security