diff --git a/openpower/configs/witherspoon_defconfig b/openpower/configs/witherspoon_defconfig
index f98a884..ba13d03 100644
--- a/openpower/configs/witherspoon_defconfig
+++ b/openpower/configs/witherspoon_defconfig
@@ -40,7 +40,7 @@
 BR2_OPENPOWER_POWER9=y
 BR2_HOSTBOOT_CONFIG_FILE="witherspoon.config"
 BR2_OPENPOWER_MACHINE_XML_GITHUB_PROJECT_VALUE="witherspoon-xml"
-BR2_OPENPOWER_MACHINE_XML_VERSION="7bec10c197071f8fa78b108275675693bfe13403"
+BR2_OPENPOWER_MACHINE_XML_VERSION="24d2f6d98568f0b23d1eb3bb9f876a638be4ae37"
 BR2_OPENPOWER_MACHINE_XML_FILENAME="witherspoon.xml"
 BR2_OPENPOWER_SYSTEM_XML_FILENAME="WITHERSPOON_hb.system.xml"
 BR2_OPENPOWER_MRW_XML_FILENAME="WITHERSPOON_hb.mrw.xml"
diff --git a/openpower/configs/zaius_defconfig b/openpower/configs/zaius_defconfig
index 3c01088..d788da0 100644
--- a/openpower/configs/zaius_defconfig
+++ b/openpower/configs/zaius_defconfig
@@ -40,7 +40,7 @@
 BR2_OPENPOWER_POWER9=y
 BR2_HOSTBOOT_CONFIG_FILE="zaius.config"
 BR2_OPENPOWER_MACHINE_XML_GITHUB_PROJECT_VALUE="zaius-xml"
-BR2_OPENPOWER_MACHINE_XML_VERSION="9325c75307807915197f4704ab7e6d8994e2c837"
+BR2_OPENPOWER_MACHINE_XML_VERSION="7b63cfae75ef13789db5c71557c24c69d854413f"
 BR2_OPENPOWER_MACHINE_XML_FILENAME="zaius.xml"
 BR2_OPENPOWER_SYSTEM_XML_FILENAME="ZAIUS_hb.system.xml"
 BR2_OPENPOWER_MRW_XML_FILENAME="ZAIUS_hb.mrw.xml"
diff --git a/openpower/package/Config.in b/openpower/package/Config.in
index 68699e0..aed88b6 100755
--- a/openpower/package/Config.in
+++ b/openpower/package/Config.in
@@ -17,4 +17,5 @@
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/ima-catalog/Config.in"
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sbe/Config.in"
 source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sb-signing-utils/Config.in"
+source "$BR2_EXTERNAL_OP_BUILD_PATH/package/sb-signing-framework/Config.in"
 
diff --git a/openpower/package/hostboot-binaries/hostboot_binaries.mk b/openpower/package/hostboot-binaries/hostboot_binaries.mk
index f8105a3..4ea66d7 100644
--- a/openpower/package/hostboot-binaries/hostboot_binaries.mk
+++ b/openpower/package/hostboot-binaries/hostboot_binaries.mk
@@ -4,6 +4,7 @@
 #
 ################################################################################
 
+
 HOSTBOOT_BINARIES_VERSION ?= ed06137f062d6a716d2a89d852aac984036db256
 HOSTBOOT_BINARIES_SITE ?= $(call github,open-power,hostboot-binaries,$(HOSTBOOT_BINARIES_VERSION))
 
diff --git a/openpower/package/hostboot/hostboot.mk b/openpower/package/hostboot/hostboot.mk
index 0accc0c..f67d368 100644
--- a/openpower/package/hostboot/hostboot.mk
+++ b/openpower/package/hostboot/hostboot.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 HOSTBOOT_VERSION_BRANCH_MASTER_P8 ?= 695bd891343faf1f0ef85fe53148590e58239efd
-HOSTBOOT_VERSION_BRANCH_MASTER ?= a19748cc4dbe3feff90fb95ffa7b9a474fdc7660
+HOSTBOOT_VERSION_BRANCH_MASTER ?= 8e7e2adfdfe90a1061ce87b8a657bab152a73358
 
 HOSTBOOT_VERSION ?= $(if $(BR2_OPENPOWER_POWER9),$(HOSTBOOT_VERSION_BRANCH_MASTER),$(HOSTBOOT_VERSION_BRANCH_MASTER_P8))
 HOSTBOOT_SITE ?= $(call github,open-power,hostboot,$(HOSTBOOT_VERSION))
diff --git a/openpower/package/openpower-pnor/Config.in b/openpower/package/openpower-pnor/Config.in
index 644d281..37c4470 100644
--- a/openpower/package/openpower-pnor/Config.in
+++ b/openpower/package/openpower-pnor/Config.in
@@ -39,6 +39,7 @@
 
 config BR2_OPENPOWER_SECUREBOOT_SIGN_MODE
         string "Secureboot signing mode"
+        default "development"
         help
             Available options [development | production]
             Indicates the signing mode when generating the PNOR image.  Only
diff --git a/openpower/package/pkg-versions.mk b/openpower/package/pkg-versions.mk
index 9a37bbb..be50245 100644
--- a/openpower/package/pkg-versions.mk
+++ b/openpower/package/pkg-versions.mk
@@ -134,7 +134,7 @@
 
 UPPER_CASE_PKG = $(call UPPERCASE,$(1))
 $$(UPPER_CASE_PKG)_VERSION_FILE = $$(OPENPOWER_VERSION_DIR)/$(1).version.txt
-
+UPPER_CASE_SIGN_MODE = $(call UPPERCASE,$$(BR2_OPENPOWER_SECUREBOOT_SIGN_MODE))
 
 $$(eval $$(foreach pkg,$$(OPENPOWER_VERSIONED_SUBPACKAGES), \
 		$$(call OPENPOWER_SUBPACKAGE_VERSION,$$(pkg),$$(call UPPERCASE,$$(pkg)))))
@@ -168,6 +168,11 @@
 	>> $$($$(UPPER_CASE_PKG)_VERSION_FILE); \
 fi
 
+# Flag whether op-build is production signed
+if [ "$$(UPPER_CASE_SIGN_MODE)" == 'PRODUCTION' ]; then \
+	echo -n "-prod" >> $$($$(UPPER_CASE_PKG)_VERSION_FILE); \
+fi
+
 # Add new line to $$($$(UPPER_CASE_PKG)_VERSION_FILE)
 echo "" >> $$($$(UPPER_CASE_PKG)_VERSION_FILE);
 
diff --git a/openpower/package/sb-signing-framework/Config.in b/openpower/package/sb-signing-framework/Config.in
new file mode 100644
index 0000000..7ac3848
--- /dev/null
+++ b/openpower/package/sb-signing-framework/Config.in
@@ -0,0 +1,5 @@
+config BR2_PACKAGE_HOST_SB_SIGNING_FRAMEWORK
+        bool "OpenPOWER secureboot signing server interface"
+        default y if BR2_OPENPOWER_PLATFORM && ((BR2_OPENPOWER_SECUREBOOT_SIGN_MODE = "production") || (BR2_OPENPOWER_SECUREBOOT_KEY_TRANSITION_TO_PROD) )
+        help
+            Client interface to signing server for signing OpenPOWER firmware images
diff --git a/openpower/package/sb-signing-framework/sb-signing-framework.mk b/openpower/package/sb-signing-framework/sb-signing-framework.mk
new file mode 100644
index 0000000..6338ae0
--- /dev/null
+++ b/openpower/package/sb-signing-framework/sb-signing-framework.mk
@@ -0,0 +1,27 @@
+################################################################################
+#
+#  sb-signing-framework
+#
+################################################################################
+
+SB_SIGNING_FRAMEWORK_SITE ?= $(call github,open-power,sb-signing-framework,$(SB_SIGNING_FRAMEWORK_VERSION))
+
+SB_SIGNING_FRAMEWORK_LICENSE = Apache-2.0
+SB_SIGNING_FRAMEWORK_LICENSE_FILES = LICENSE
+SB_SIGNING_FRAMEWORK_VERSION ?= 02ed29aa11136a6d9a6e1f075772532c43cb7289
+
+HOST_SB_SIGNING_FRAMEWORK_DEPENDENCIES = host-openssl
+
+define HOST_SB_SIGNING_FRAMEWORK_BUILD_CMDS
+	CFLAGS="-I $(HOST_DIR)/usr/include -Wl,-rpath -Wl,$(HOST_DIR)/usr/lib" \
+		$(HOST_MAKE_ENV) $(MAKE) -C $(@D)/src/client/
+endef
+
+define HOST_SB_SIGNING_FRAMEWORK_COPY_FILES
+		$(INSTALL) -m 0755 $(@D)/src/client/sf_client $(HOST_DIR)/usr/bin/
+endef
+
+HOST_SB_SIGNING_FRAMEWORK_POST_INSTALL_HOOKS += HOST_SB_SIGNING_FRAMEWORK_COPY_FILES
+
+$(eval $(host-generic-package))
+
diff --git a/openpower/package/sb-signing-utils/Config.in b/openpower/package/sb-signing-utils/Config.in
index 87df6f3..b834f46 100644
--- a/openpower/package/sb-signing-utils/Config.in
+++ b/openpower/package/sb-signing-utils/Config.in
@@ -1,5 +1,5 @@
 config BR2_PACKAGE_HOST_SB_SIGNING_UTILS
         bool "OpenPOWER secureboot signing utilities"
-        default y if (BR2_OPENPOWER_PLATFORM && BR2_OPENPOWER_SECUREBOOT_ENABLED)
+        default y if (BR2_OPENPOWER_PLATFORM)
         help
             Secureboot utilities for signing OpenPOWER firmware images
diff --git a/openpower/package/sb-signing-utils/sb-signing-utils.mk b/openpower/package/sb-signing-utils/sb-signing-utils.mk
index de8b5eb..0dbb4d0 100644
--- a/openpower/package/sb-signing-utils/sb-signing-utils.mk
+++ b/openpower/package/sb-signing-utils/sb-signing-utils.mk
@@ -12,6 +12,12 @@
 
 HOST_SB_SIGNING_UTILS_DEPENDENCIES = host-openssl
 
+ifeq ($(BR2_OPENPOWER_SECUREBOOT_SIGN_MODE),production)
+HOST_SB_SIGNING_UTILS_DEPENDENCIES += host-sb-signing-framework
+else ifeq ($(BR2_OPENPOWER_SECUREBOOT_KEY_TRANSITION_TO_PROD),y)
+HOST_SB_SIGNING_UTILS_DEPENDENCIES += host-sb-signing-framework
+endif
+
 HOST_SB_SIGNING_UTILS_AUTORECONF = YES
 HOST_SB_SIGNING_UTILS_AUTORECONF_OPTS = -i