* [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations @ 2026-10-08 6:09 Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska 0 siblings, 2 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska The SPL FIT signing path was signing individual images, but not the configuration. Introduce signing of configuration with images under a separate option SPL_SIGN_CONF. For now it is disabled. Enabling this option implies changes in the DTB content. The old behaviour is possible with SPL_SIGN_INDIVIDUAL, but should be removed in a subsequent patch. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/classes-recipe/uboot-sign.bbclass | 86 ++++++++++++++++++++++++-- 1 file changed, 82 insertions(+), 4 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 236d19925e..42319d15ff 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -33,6 +33,16 @@ UBOOT_FITIMAGE_ENABLE ?= "0" # Signature activation - this requires UBOOT_FITIMAGE_ENABLE = "1" SPL_SIGN_ENABLE ?= "0" +# Sign the FIT configuration in the SPL signing flow. Configuration +# signatures bind the selected images and boot metadata together. +SPL_SIGN_CONF ?= "0" + +# Legacy compatibility knob for per-image signatures in the SPL FIT path. +# Individual image signatures do not protect the configuration metadata +# which selects and parameterizes the boot images. +# INSECURE, use at your own risk +SPL_SIGN_INDIVIDUAL ?= "1" + # Default value for deployment filenames. UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" UBOOT_DTB_BINARY ?= "u-boot.dtb" @@ -327,7 +337,15 @@ uboot_fitimage_atf() { entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>; compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -354,7 +372,15 @@ uboot_fitimage_tee() { entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>; compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -395,7 +421,15 @@ uboot_fitimage_assemble() { entry = <${UBOOT_FIT_UBOOT_ENTRYPOINT}>; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -414,7 +448,15 @@ EOF compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -447,9 +489,20 @@ EOF conf_loadables="${conf_loadables}${UBOOT_FIT_CONF_USER_LOADABLES}" fi + conf_sign_images="" + conf_sign_images_sep="" + if [ -n "${UBOOT_FIT_CONF_FIRMWARE}" ] ; then conf_firmware="firmware = \"${UBOOT_FIT_CONF_FIRMWARE}\";" + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"firmware\"" + conf_sign_images_sep=", " + fi + + if [ -n "${conf_loadables}" ] ; then + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"loadables\"" + conf_sign_images_sep=", " fi + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"fdt\"" cat << EOF >> ${UBOOT_ITS} }; @@ -461,6 +514,19 @@ EOF ${conf_firmware} loadables = ${conf_loadables}; fdt = "fdt"; +EOF + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + signature { + algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; + key-name-hint = "${SPL_SIGN_KEYNAME}"; + sign-images = ${conf_sign_images}; + }; +EOF + fi + + cat << EOF >> ${UBOOT_ITS} }; }; }; @@ -475,6 +541,18 @@ EOF ${UBOOT_FITIMAGE_BINARY} if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_CONF}" != "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" != "1" ] ; then + bbfatal "SPL_SIGN_ENABLE=1 requires SPL_SIGN_CONF=1 or SPL_SIGN_INDIVIDUAL=1" + fi + + if [ "${SPL_SIGN_CONF}" != "1" ] ; then + bbwarn "SPL_SIGN_CONF is disabled. FIT configuration signing is recommended for SPL verified boot." + fi + + if [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then + bbwarn "SPL_SIGN_INDIVIDUAL=1 is enabled for compatibility only. It is INSECURE. Individual image signatures do not replace configuration signing." + fi + if [ -n "${SPL_DTB_BINARY}" ] ; then # # Sign the U-boot FIT image and add public key to SPL dtb. -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska @ 2026-10-08 6:09 ` Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska 1 sibling, 2 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska Modify testcases after adding signing of a configuration of uboot instead of various sections separately. This change includes an additional parameter to _check_signing that allows more flexible configuration and avoids assumptions on what section has, and which section does not have a signature - now they are defined in a data structure. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++--------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index 5d77e6da09..b95e6c158c 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase): self._is_req_dict_in_dict(sections, req_sections) # Call the signing related checks if the function is provided by a inherited class - self._check_signing(bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path) + self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path) def _get_req_its_paths(self, bb_vars): self.logger.error("This function needs to be implemented") @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase): self.logger.error("This function needs to be implemented") return ({}, 0) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): """Verify the signatures in the FIT image.""" self.fail("Function needs to be implemented by inheriting classes") @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase): req_sections[section]['Hash algo'] = fit_hash_alg return (req_sections, num_signatures) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): """Verify the signature nodes in the FIT image""" if bb_vars['UBOOT_SIGN_ENABLE'] == "1": self.logger.debug("Verifying signatures in the FIT image") @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase): for section, values in sections.items(): # Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") if section.startswith(bb_vars['FIT_CONF_PREFIX']): + if 'Sign algo' not in req_values[section]: + continue sign_algo = values.get('Sign algo', None) req_sign_algo = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname) self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase): 'SPL_MKIMAGE_SIGN_ARGS', 'SPL_SIGN_ENABLE', 'SPL_SIGN_KEYNAME', + 'SPL_SIGN_INDIVIDUAL', + 'SPL_SIGN_CONF', 'TOPDIR', 'UBOOT_ARCH', 'UBOOT_DTB_BINARY', @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase): req_its_paths = [] for image in images: req_its_paths.append(['/', 'images', image]) - if bb_vars['SPL_SIGN_ENABLE'] == "1": + if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_INDIVIDUAL'] == "1": req_its_paths.append(['/', 'images', image, 'signature']) + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1": + req_its_paths.append(['/', 'images', image, 'hash-1']) for configuration in configurations: req_its_paths.append(['/', 'configurations', configuration]) + if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1": + req_its_paths.append(['/', 'configurations', 'conf', 'signature']) return (req_its_paths, []) def _get_req_its_fields(self, bb_vars): @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase): uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG'] spl_sign_enable = bb_vars['SPL_SIGN_ENABLE'] spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME'] + spl_sign_conf = bb_vars['SPL_SIGN_CONF'] + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL'] num_signatures = 0 if spl_sign_enable == "1": for section in req_sections: - if not section.startswith('conf'): - req_sections[section]['Sign algo'] = "%s,%s:%s" % \ - (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) - num_signatures += 1 + if section.startswith('conf'): + if spl_sign_conf == "1": + req_sections[section]['Sign algo'] = "%s,%s:%s" % \ + (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + num_signatures += 1 + else: + if spl_sign_conf == "1": + req_sections[section]['Hash algo'] = uboot_fit_hash_alg + elif spl_sign_individual == "1": + req_sections[section]['Sign algo'] = "%s,%s:%s" % \ + (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + num_signatures += 1 return (req_sections, num_signatures) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and bb_vars['SPL_SIGN_ENABLE'] == "1": self.logger.debug("Verifying signatures in the FIT image") else: @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase): fit_sign_alg_len = FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg] for section, values in sections.items(): # Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") - if section.startswith("conf"): - # uboot-sign does not sign configuration nodes - pass - else: - # uboot-sign does not add hash nodes, only image signatures - sign_algo = values.get('Sign algo', None) - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) - self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) - sign_value = values.get('Sign value', None) - self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section) + if 'Sign algo' not in req_sections[section]: + continue + sign_algo = values.get('Sign algo', None) + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) + sign_value = values.get('Sign value', None) + self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section) # Search for the string passed to mkimage in each signed section of the FIT image. # Looks like mkimage supports to add a comment but does not support to read it back. -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska @ 2026-10-09 9:13 ` Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 1 sibling, 0 replies; 5+ messages in thread From: Mathieu Dubois-Briand @ 2026-10-09 9:13 UTC (permalink / raw) To: rybczynska, openembedded-core; +Cc: a.fatoum, adrian.freihofer On Thu Oct 8, 2026 at 8:09 AM CEST, Marta Rybczynska via lists.openembedded.org wrote: > Modify testcases after adding signing of a configuration of uboot instead > of various sections separately. > > This change includes an additional parameter to _check_signing that allows > more flexible configuration and avoids assumptions on what section has, > and which section does not have a signature - now they are defined > in a data structure. > > Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> > --- Hi Marta, Thanks for the new version. It looks like the selftest is failing here: 2026-10-09 07:38:19,536 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase) 2026-10-09 07:38:19,536 - oe-selftest - INFO - ... ERROR ... 2026-10-09 07:38:19,537 - oe-selftest - INFO - 13: 7/35 462/773 (190.09s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs) 2026-10-09 07:38:19,537 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last): File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1414, in test_fit_image_sign_initramfs self._test_fitimage(bb_vars) ~~~~~~~~~~~~~~~~~~~^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 660, in _test_fitimage self._check_fitimage(bb_vars, fitimage_path, uboot_tools_bindir) ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 617, in _check_fitimage self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path) ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1108, in _check_signing if 'Sign algo' not in req_values[section]: ^^^^^^^^^^ NameError: name 'req_values' is not defined https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4842 https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/5029 Can you have a look at the issue? Thanks, Mathieu -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand @ 2026-10-09 13:53 ` Freihofer, Adrian 1 sibling, 0 replies; 5+ messages in thread From: Freihofer, Adrian @ 2026-10-09 13:53 UTC (permalink / raw) To: Marta Rybczynska, openembedded-core@lists.openembedded.org Cc: a.fatoum@pengutronix.de On Thu, 2026-10-08 at 08:09 +0200, Marta Rybczynska wrote: > Modify testcases after adding signing of a configuration of uboot > instead > of various sections separately. > > This change includes an additional parameter to _check_signing that > allows > more flexible configuration and avoids assumptions on what section > has, > and which section does not have a signature - now they are defined > in a data structure. > > Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> > --- > meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++------- > -- > 1 file changed, 34 insertions(+), 19 deletions(-) > > diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py > b/meta/lib/oeqa/selftest/cases/fitimage.py > index 5d77e6da09..b95e6c158c 100644 > --- a/meta/lib/oeqa/selftest/cases/fitimage.py > +++ b/meta/lib/oeqa/selftest/cases/fitimage.py > @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase): > self._is_req_dict_in_dict(sections, req_sections) > > # Call the signing related checks if the function is > provided by a inherited class > - self._check_signing(bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path) > + self._check_signing(bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path) > > def _get_req_its_paths(self, bb_vars): > self.logger.error("This function needs to be implemented") > @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase): > self.logger.error("This function needs to be implemented") > return ({}, 0) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > """Verify the signatures in the FIT image.""" > self.fail("Function needs to be implemented by inheriting > classes") > > @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase): > req_sections[section]['Hash algo'] = > fit_hash_alg > return (req_sections, num_signatures) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > """Verify the signature nodes in the FIT image""" > if bb_vars['UBOOT_SIGN_ENABLE'] == "1": > self.logger.debug("Verifying signatures in the FIT > image") > @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase): > for section, values in sections.items(): > # Configuration nodes are always signed with > UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") > if section.startswith(bb_vars['FIT_CONF_PREFIX']): > + if 'Sign algo' not in req_values[section]: This should probably look like: if 'Sign algo' not in req_sections[section]: Thanks for the work on this series—overall it's shaping up nicely and we should be able to get it ready to merge soon. Regarding testing: I noticed the same bug was already flagged and commented on in v3. Could we double-check how this was tested? Running oe-selftest per commit would be really helpful here, especially to prove that the first two commits are stable enough to backport to the LTS branch later. Regards, Adrian > + continue > sign_algo = values.get('Sign algo', None) > req_sign_algo = "%s,%s:%s" % (fit_hash_alg, > fit_sign_alg, uboot_sign_keyname) > self.assertEqual(sign_algo, req_sign_algo, > 'Signature algorithm for %s not expected value' % section) > @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase): > 'SPL_MKIMAGE_SIGN_ARGS', > 'SPL_SIGN_ENABLE', > 'SPL_SIGN_KEYNAME', > + 'SPL_SIGN_INDIVIDUAL', > + 'SPL_SIGN_CONF', > 'TOPDIR', > 'UBOOT_ARCH', > 'UBOOT_DTB_BINARY', > @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase): > req_its_paths = [] > for image in images: > req_its_paths.append(['/', 'images', image]) > - if bb_vars['SPL_SIGN_ENABLE'] == "1": > + if bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_INDIVIDUAL'] == "1": > req_its_paths.append(['/', 'images', image, > 'signature']) > + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_CONF'] == "1": > + req_its_paths.append(['/', 'images', image, 'hash- > 1']) > for configuration in configurations: > req_its_paths.append(['/', 'configurations', > configuration]) > + if bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_CONF'] == "1": > + req_its_paths.append(['/', 'configurations', 'conf', > 'signature']) > return (req_its_paths, []) > > def _get_req_its_fields(self, bb_vars): > @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase): > uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG'] > spl_sign_enable = bb_vars['SPL_SIGN_ENABLE'] > spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME'] > + spl_sign_conf = bb_vars['SPL_SIGN_CONF'] > + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL'] > num_signatures = 0 > if spl_sign_enable == "1": > for section in req_sections: > - if not section.startswith('conf'): > - req_sections[section]['Sign algo'] = "%s,%s:%s" > % \ > - (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > - num_signatures += 1 > + if section.startswith('conf'): > + if spl_sign_conf == "1": > + req_sections[section]['Sign algo'] = > "%s,%s:%s" % \ > + (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > + num_signatures += 1 > + else: > + if spl_sign_conf == "1": > + req_sections[section]['Hash algo'] = > uboot_fit_hash_alg > + elif spl_sign_individual == "1": > + req_sections[section]['Sign algo'] = > "%s,%s:%s" % \ > + (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > + num_signatures += 1 > return (req_sections, num_signatures) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and > bb_vars['SPL_SIGN_ENABLE'] == "1": > self.logger.debug("Verifying signatures in the FIT > image") > else: > @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase): > fit_sign_alg_len = > FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg] > for section, values in sections.items(): > # Configuration nodes are always signed with > UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") > - if section.startswith("conf"): > - # uboot-sign does not sign configuration nodes > - pass > - else: > - # uboot-sign does not add hash nodes, only image > signatures > - sign_algo = values.get('Sign algo', None) > - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, > uboot_fit_sign_alg, spl_sign_keyname) > - self.assertEqual(sign_algo, req_sign_algo, > 'Signature algorithm for %s not expected value' % section) > - sign_value = values.get('Sign value', None) > - self.assertEqual(len(sign_value), fit_sign_alg_len, > 'Signature value for section %s not expected length' % section) > + if 'Sign algo' not in req_sections[section]: > + continue > + sign_algo = values.get('Sign algo', None) > + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, > uboot_fit_sign_alg, spl_sign_keyname) > + self.assertEqual(sign_algo, req_sign_algo, 'Signature > algorithm for %s not expected value' % section) > + sign_value = values.get('Sign value', None) > + self.assertEqual(len(sign_value), fit_sign_alg_len, > 'Signature value for section %s not expected length' % section) > > # Search for the string passed to mkimage in each signed > section of the FIT image. > # Looks like mkimage supports to add a comment but does not > support to read it back. ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska @ 2026-10-08 6:09 ` Marta Rybczynska 1 sibling, 0 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska This commit enables signing SPL FIT configuration instead of specific elements. This introduces an incompatibility with the previous behavior, but is the correct way to do. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/classes-recipe/uboot-sign.bbclass | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 42319d15ff..85138bc948 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -35,13 +35,13 @@ SPL_SIGN_ENABLE ?= "0" # Sign the FIT configuration in the SPL signing flow. Configuration # signatures bind the selected images and boot metadata together. -SPL_SIGN_CONF ?= "0" +SPL_SIGN_CONF ?= "1" # Legacy compatibility knob for per-image signatures in the SPL FIT path. # Individual image signatures do not protect the configuration metadata # which selects and parameterizes the boot images. # INSECURE, use at your own risk -SPL_SIGN_INDIVIDUAL ?= "1" +SPL_SIGN_INDIVIDUAL ?= "0" # Default value for deployment filenames. UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-09 13:53 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.