* [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations
@ 2026-10-08 6:09 Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
0 siblings, 2 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
The SPL FIT signing path was signing individual images, but not the configuration.
Introduce signing of configuration with images under a separate option SPL_SIGN_CONF.
For now it is disabled. Enabling this option implies changes in the DTB content.
The old behaviour is possible with SPL_SIGN_INDIVIDUAL, but should be removed in
a subsequent patch.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/classes-recipe/uboot-sign.bbclass | 86 ++++++++++++++++++++++++--
1 file changed, 82 insertions(+), 4 deletions(-)
diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 236d19925e..42319d15ff 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -33,6 +33,16 @@ UBOOT_FITIMAGE_ENABLE ?= "0"
# Signature activation - this requires UBOOT_FITIMAGE_ENABLE = "1"
SPL_SIGN_ENABLE ?= "0"
+# Sign the FIT configuration in the SPL signing flow. Configuration
+# signatures bind the selected images and boot metadata together.
+SPL_SIGN_CONF ?= "0"
+
+# Legacy compatibility knob for per-image signatures in the SPL FIT path.
+# Individual image signatures do not protect the configuration metadata
+# which selects and parameterizes the boot images.
+# INSECURE, use at your own risk
+SPL_SIGN_INDIVIDUAL ?= "1"
+
# Default value for deployment filenames.
UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
UBOOT_DTB_BINARY ?= "u-boot.dtb"
@@ -327,7 +337,15 @@ uboot_fitimage_atf() {
entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>;
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -354,7 +372,15 @@ uboot_fitimage_tee() {
entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>;
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -395,7 +421,15 @@ uboot_fitimage_assemble() {
entry = <${UBOOT_FIT_UBOOT_ENTRYPOINT}>;
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -414,7 +448,15 @@ EOF
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -447,9 +489,20 @@ EOF
conf_loadables="${conf_loadables}${UBOOT_FIT_CONF_USER_LOADABLES}"
fi
+ conf_sign_images=""
+ conf_sign_images_sep=""
+
if [ -n "${UBOOT_FIT_CONF_FIRMWARE}" ] ; then
conf_firmware="firmware = \"${UBOOT_FIT_CONF_FIRMWARE}\";"
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"firmware\""
+ conf_sign_images_sep=", "
+ fi
+
+ if [ -n "${conf_loadables}" ] ; then
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"loadables\""
+ conf_sign_images_sep=", "
fi
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"fdt\""
cat << EOF >> ${UBOOT_ITS}
};
@@ -461,6 +514,19 @@ EOF
${conf_firmware}
loadables = ${conf_loadables};
fdt = "fdt";
+EOF
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ signature {
+ algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
+ key-name-hint = "${SPL_SIGN_KEYNAME}";
+ sign-images = ${conf_sign_images};
+ };
+EOF
+ fi
+
+ cat << EOF >> ${UBOOT_ITS}
};
};
};
@@ -475,6 +541,18 @@ EOF
${UBOOT_FITIMAGE_BINARY}
if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_CONF}" != "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" != "1" ] ; then
+ bbfatal "SPL_SIGN_ENABLE=1 requires SPL_SIGN_CONF=1 or SPL_SIGN_INDIVIDUAL=1"
+ fi
+
+ if [ "${SPL_SIGN_CONF}" != "1" ] ; then
+ bbwarn "SPL_SIGN_CONF is disabled. FIT configuration signing is recommended for SPL verified boot."
+ fi
+
+ if [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
+ bbwarn "SPL_SIGN_INDIVIDUAL=1 is enabled for compatibility only. It is INSECURE. Individual image signatures do not replace configuration signing."
+ fi
+
if [ -n "${SPL_DTB_BINARY}" ] ; then
#
# Sign the U-boot FIT image and add public key to SPL dtb.
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
@ 2026-10-08 6:09 ` Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
1 sibling, 2 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
Modify testcases after adding signing of a configuration of uboot instead
of various sections separately.
This change includes an additional parameter to _check_signing that allows
more flexible configuration and avoids assumptions on what section has,
and which section does not have a signature - now they are defined
in a data structure.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++---------
1 file changed, 34 insertions(+), 19 deletions(-)
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index 5d77e6da09..b95e6c158c 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase):
self._is_req_dict_in_dict(sections, req_sections)
# Call the signing related checks if the function is provided by a inherited class
- self._check_signing(bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path)
+ self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path)
def _get_req_its_paths(self, bb_vars):
self.logger.error("This function needs to be implemented")
@@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase):
self.logger.error("This function needs to be implemented")
return ({}, 0)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
"""Verify the signatures in the FIT image."""
self.fail("Function needs to be implemented by inheriting classes")
@@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase):
req_sections[section]['Hash algo'] = fit_hash_alg
return (req_sections, num_signatures)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
"""Verify the signature nodes in the FIT image"""
if bb_vars['UBOOT_SIGN_ENABLE'] == "1":
self.logger.debug("Verifying signatures in the FIT image")
@@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase):
for section, values in sections.items():
# Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
if section.startswith(bb_vars['FIT_CONF_PREFIX']):
+ if 'Sign algo' not in req_values[section]:
+ continue
sign_algo = values.get('Sign algo', None)
req_sign_algo = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname)
self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
@@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase):
'SPL_MKIMAGE_SIGN_ARGS',
'SPL_SIGN_ENABLE',
'SPL_SIGN_KEYNAME',
+ 'SPL_SIGN_INDIVIDUAL',
+ 'SPL_SIGN_CONF',
'TOPDIR',
'UBOOT_ARCH',
'UBOOT_DTB_BINARY',
@@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase):
req_its_paths = []
for image in images:
req_its_paths.append(['/', 'images', image])
- if bb_vars['SPL_SIGN_ENABLE'] == "1":
+ if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_INDIVIDUAL'] == "1":
req_its_paths.append(['/', 'images', image, 'signature'])
+ elif bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1":
+ req_its_paths.append(['/', 'images', image, 'hash-1'])
for configuration in configurations:
req_its_paths.append(['/', 'configurations', configuration])
+ if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1":
+ req_its_paths.append(['/', 'configurations', 'conf', 'signature'])
return (req_its_paths, [])
def _get_req_its_fields(self, bb_vars):
@@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase):
uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG']
spl_sign_enable = bb_vars['SPL_SIGN_ENABLE']
spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME']
+ spl_sign_conf = bb_vars['SPL_SIGN_CONF']
+ spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL']
num_signatures = 0
if spl_sign_enable == "1":
for section in req_sections:
- if not section.startswith('conf'):
- req_sections[section]['Sign algo'] = "%s,%s:%s" % \
- (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
- num_signatures += 1
+ if section.startswith('conf'):
+ if spl_sign_conf == "1":
+ req_sections[section]['Sign algo'] = "%s,%s:%s" % \
+ (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ num_signatures += 1
+ else:
+ if spl_sign_conf == "1":
+ req_sections[section]['Hash algo'] = uboot_fit_hash_alg
+ elif spl_sign_individual == "1":
+ req_sections[section]['Sign algo'] = "%s,%s:%s" % \
+ (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ num_signatures += 1
return (req_sections, num_signatures)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and bb_vars['SPL_SIGN_ENABLE'] == "1":
self.logger.debug("Verifying signatures in the FIT image")
else:
@@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase):
fit_sign_alg_len = FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg]
for section, values in sections.items():
# Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
- if section.startswith("conf"):
- # uboot-sign does not sign configuration nodes
- pass
- else:
- # uboot-sign does not add hash nodes, only image signatures
- sign_algo = values.get('Sign algo', None)
- req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
- self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
- sign_value = values.get('Sign value', None)
- self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section)
+ if 'Sign algo' not in req_sections[section]:
+ continue
+ sign_algo = values.get('Sign algo', None)
+ req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
+ sign_value = values.get('Sign value', None)
+ self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section)
# Search for the string passed to mkimage in each signed section of the FIT image.
# Looks like mkimage supports to add a comment but does not support to read it back.
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
@ 2026-10-08 6:09 ` Marta Rybczynska
1 sibling, 0 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
This commit enables signing SPL FIT configuration instead of specific
elements. This introduces an incompatibility with the previous behavior,
but is the correct way to do.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/classes-recipe/uboot-sign.bbclass | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 42319d15ff..85138bc948 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -35,13 +35,13 @@ SPL_SIGN_ENABLE ?= "0"
# Sign the FIT configuration in the SPL signing flow. Configuration
# signatures bind the selected images and boot metadata together.
-SPL_SIGN_CONF ?= "0"
+SPL_SIGN_CONF ?= "1"
# Legacy compatibility knob for per-image signatures in the SPL FIT path.
# Individual image signatures do not protect the configuration metadata
# which selects and parameterizes the boot images.
# INSECURE, use at your own risk
-SPL_SIGN_INDIVIDUAL ?= "1"
+SPL_SIGN_INDIVIDUAL ?= "0"
# Default value for deployment filenames.
UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
@ 2026-10-09 9:13 ` Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
1 sibling, 0 replies; 5+ messages in thread
From: Mathieu Dubois-Briand @ 2026-10-09 9:13 UTC (permalink / raw)
To: rybczynska, openembedded-core; +Cc: a.fatoum, adrian.freihofer
On Thu Oct 8, 2026 at 8:09 AM CEST, Marta Rybczynska via lists.openembedded.org wrote:
> Modify testcases after adding signing of a configuration of uboot instead
> of various sections separately.
>
> This change includes an additional parameter to _check_signing that allows
> more flexible configuration and avoids assumptions on what section has,
> and which section does not have a signature - now they are defined
> in a data structure.
>
> Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
> ---
Hi Marta,
Thanks for the new version.
It looks like the selftest is failing here:
2026-10-09 07:38:19,536 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase)
2026-10-09 07:38:19,536 - oe-selftest - INFO - ... ERROR
...
2026-10-09 07:38:19,537 - oe-selftest - INFO - 13: 7/35 462/773 (190.09s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs)
2026-10-09 07:38:19,537 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1414, in test_fit_image_sign_initramfs
self._test_fitimage(bb_vars)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 660, in _test_fitimage
self._check_fitimage(bb_vars, fitimage_path, uboot_tools_bindir)
~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 617, in _check_fitimage
self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1108, in _check_signing
if 'Sign algo' not in req_values[section]:
^^^^^^^^^^
NameError: name 'req_values' is not defined
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4842
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/5029
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
@ 2026-10-09 13:53 ` Freihofer, Adrian
1 sibling, 0 replies; 5+ messages in thread
From: Freihofer, Adrian @ 2026-10-09 13:53 UTC (permalink / raw)
To: Marta Rybczynska, openembedded-core@lists.openembedded.org
Cc: a.fatoum@pengutronix.de
On Thu, 2026-10-08 at 08:09 +0200, Marta Rybczynska wrote:
> Modify testcases after adding signing of a configuration of uboot
> instead
> of various sections separately.
>
> This change includes an additional parameter to _check_signing that
> allows
> more flexible configuration and avoids assumptions on what section
> has,
> and which section does not have a signature - now they are defined
> in a data structure.
>
> Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
> ---
> meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++-------
> --
> 1 file changed, 34 insertions(+), 19 deletions(-)
>
> diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py
> b/meta/lib/oeqa/selftest/cases/fitimage.py
> index 5d77e6da09..b95e6c158c 100644
> --- a/meta/lib/oeqa/selftest/cases/fitimage.py
> +++ b/meta/lib/oeqa/selftest/cases/fitimage.py
> @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase):
> self._is_req_dict_in_dict(sections, req_sections)
>
> # Call the signing related checks if the function is
> provided by a inherited class
> - self._check_signing(bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path)
> + self._check_signing(bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path)
>
> def _get_req_its_paths(self, bb_vars):
> self.logger.error("This function needs to be implemented")
> @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase):
> self.logger.error("This function needs to be implemented")
> return ({}, 0)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> """Verify the signatures in the FIT image."""
> self.fail("Function needs to be implemented by inheriting
> classes")
>
> @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase):
> req_sections[section]['Hash algo'] =
> fit_hash_alg
> return (req_sections, num_signatures)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> """Verify the signature nodes in the FIT image"""
> if bb_vars['UBOOT_SIGN_ENABLE'] == "1":
> self.logger.debug("Verifying signatures in the FIT
> image")
> @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase):
> for section, values in sections.items():
> # Configuration nodes are always signed with
> UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
> if section.startswith(bb_vars['FIT_CONF_PREFIX']):
> + if 'Sign algo' not in req_values[section]:
This should probably look like:
if 'Sign algo' not in req_sections[section]:
Thanks for the work on this series—overall it's shaping up nicely and
we should be able to get it ready to merge soon.
Regarding testing: I noticed the same bug was already flagged and
commented on in v3. Could we double-check how this was tested? Running
oe-selftest per commit would be really helpful here, especially to
prove that the first two commits are stable enough to backport to the
LTS branch later.
Regards,
Adrian
> + continue
> sign_algo = values.get('Sign algo', None)
> req_sign_algo = "%s,%s:%s" % (fit_hash_alg,
> fit_sign_alg, uboot_sign_keyname)
> self.assertEqual(sign_algo, req_sign_algo,
> 'Signature algorithm for %s not expected value' % section)
> @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase):
> 'SPL_MKIMAGE_SIGN_ARGS',
> 'SPL_SIGN_ENABLE',
> 'SPL_SIGN_KEYNAME',
> + 'SPL_SIGN_INDIVIDUAL',
> + 'SPL_SIGN_CONF',
> 'TOPDIR',
> 'UBOOT_ARCH',
> 'UBOOT_DTB_BINARY',
> @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase):
> req_its_paths = []
> for image in images:
> req_its_paths.append(['/', 'images', image])
> - if bb_vars['SPL_SIGN_ENABLE'] == "1":
> + if bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_INDIVIDUAL'] == "1":
> req_its_paths.append(['/', 'images', image,
> 'signature'])
> + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_CONF'] == "1":
> + req_its_paths.append(['/', 'images', image, 'hash-
> 1'])
> for configuration in configurations:
> req_its_paths.append(['/', 'configurations',
> configuration])
> + if bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_CONF'] == "1":
> + req_its_paths.append(['/', 'configurations', 'conf',
> 'signature'])
> return (req_its_paths, [])
>
> def _get_req_its_fields(self, bb_vars):
> @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase):
> uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG']
> spl_sign_enable = bb_vars['SPL_SIGN_ENABLE']
> spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME']
> + spl_sign_conf = bb_vars['SPL_SIGN_CONF']
> + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL']
> num_signatures = 0
> if spl_sign_enable == "1":
> for section in req_sections:
> - if not section.startswith('conf'):
> - req_sections[section]['Sign algo'] = "%s,%s:%s"
> % \
> - (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> - num_signatures += 1
> + if section.startswith('conf'):
> + if spl_sign_conf == "1":
> + req_sections[section]['Sign algo'] =
> "%s,%s:%s" % \
> + (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> + num_signatures += 1
> + else:
> + if spl_sign_conf == "1":
> + req_sections[section]['Hash algo'] =
> uboot_fit_hash_alg
> + elif spl_sign_individual == "1":
> + req_sections[section]['Sign algo'] =
> "%s,%s:%s" % \
> + (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> + num_signatures += 1
> return (req_sections, num_signatures)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and
> bb_vars['SPL_SIGN_ENABLE'] == "1":
> self.logger.debug("Verifying signatures in the FIT
> image")
> else:
> @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase):
> fit_sign_alg_len =
> FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg]
> for section, values in sections.items():
> # Configuration nodes are always signed with
> UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
> - if section.startswith("conf"):
> - # uboot-sign does not sign configuration nodes
> - pass
> - else:
> - # uboot-sign does not add hash nodes, only image
> signatures
> - sign_algo = values.get('Sign algo', None)
> - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg,
> uboot_fit_sign_alg, spl_sign_keyname)
> - self.assertEqual(sign_algo, req_sign_algo,
> 'Signature algorithm for %s not expected value' % section)
> - sign_value = values.get('Sign value', None)
> - self.assertEqual(len(sign_value), fit_sign_alg_len,
> 'Signature value for section %s not expected length' % section)
> + if 'Sign algo' not in req_sections[section]:
> + continue
> + sign_algo = values.get('Sign algo', None)
> + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg,
> uboot_fit_sign_alg, spl_sign_keyname)
> + self.assertEqual(sign_algo, req_sign_algo, 'Signature
> algorithm for %s not expected value' % section)
> + sign_value = values.get('Sign value', None)
> + self.assertEqual(len(sign_value), fit_sign_alg_len,
> 'Signature value for section %s not expected length' % section)
>
> # Search for the string passed to mkimage in each signed
> section of the FIT image.
> # Looks like mkimage supports to add a comment but does not
> support to read it back.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-09 13:53 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.