/usr/bin/rpi-eeprom-digest

Illegal option --
Unknown argument "?"
rpi-eeprom-digest [-k RSA_KEY] -i IMAGE -o OUTPUT

Tool to generate .sig files containing the SHA256 digest and optional
RSA signature. Typically this tool is used by rpi-eeprom-update to
generate a hash to guard against file-system corruption for EEPROM updates
OR for signing OS images (boot.img) for secure-boot.

This tool CANNOT be used directly to sign a bootloader EEPROM image
for secure-boot because the signed data is the bootloader configuration file
rather than the entire flash image.
To create signed bootloader images, please see
https://github.com/raspberrypi/usbboot/tree/master/secure-boot-recovery/README.md


Options:
   -i The source image, e.g., boot.img
   -o The name of the digest/signature file
   -k Optional RSA private key
   -H The name of the HSM wrapper script to invoke - default ""

RSA signing:
If a private key in PEM format or a PKCS#11 URI is supplied, then the
RSA signature of the SHA256 digest is included in the .sig
file. Currently, the bootloader only supports SHA256 digests signed
with a 2048-bit RSA key. The bootloader only verifies RSA signatures
in signed boot mode and only for the EEPROM config file and the signed
image.

Examples:

# Generate the normal SHA256 hash to guard against file-system corruption
rpi-eeprom-digest -i pieeprom.bin -o pieeprom.sig
rpi-eeprom-digest -i vl805.bin -o vl805.sig

# Generate a signed OS ramdisk image for secure-boot
rpi-eeprom-digest -k private.pem -i boot.img -o boot.sig

# Generate RSA signature for the EEPROM config file
# As used by update-pieeprom.sh in usbboot/secure-boot-recovery
rpi-eeprom-digest -k private.pem -i bootconf.txt -o bootconf.sig

# Generate RSA signature for the EEPROM config file and delegate
# the signing process to a HSM wrapper script instead of using the private key directly.
rpi-eeprom-digest -H hsm-wrapper -i bootconf.txt -o bootconf.sig

# Similarly, but specifying the key with a PKCS#11 URI
# (Deprecated - use HSM wrapper instead)
rpi-eeprom-digest -k pkcs11:token=deadbeef;object=bl-key;type=private;pin-value=1234 -i bootconf.txt  -o bootconf.sig

# To verify the signature of an existing .sig file using the public key.
# N.B The key file must be the PUBLIC key in PEM format.
rpi-eeprom-digest -k public.pem -i boot.bin -v boot.sig