* [PATCH] kernel-fit-image: Don't add hash node when signing is enabled
@ 2026-08-19 8:21 ` jonas.juffinger
0 siblings, 0 replies; 3+ messages in thread
From: jonas.juffinger @ 2026-08-19 8:21 UTC (permalink / raw)
To: openembedded-core; +Cc: Jonas Juffinger
From: Jonas Juffinger <jonas.juffinger@liebherr.com>
When configuration signing is enabled, mkimage does not fill
the hash node even if it present. This causes the verification
to fail with a "Bad Data Hash' error because the hash exists
but it empty.
This patch adds a check to only add the hash node if signing
is not enabled.
The example FIT from the official documentation also shows
the configuration field with only the signature, without the
hash field:
https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations
Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
---
meta/lib/oe/fitimage.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
index d4dacdd508..142a5d60f7 100644
--- a/meta/lib/oe/fitimage.py
+++ b/meta/lib/oe/fitimage.py
@@ -485,7 +485,7 @@ class ItsNodeRootKernel(ItsNode):
f"{default_flag} {', '.join(conf_desc)}",
opt_props=opt_props
)
- if self._hash_algo:
+ if self._hash_algo and not self._sign_enable:
ItsNodeHash(
"hash-1",
conf_node,
---
base-commit: 6f7a806ece411ab32e4b1c08a0299400bdf3b588
change-id: 20260819-bugfix-dont-add-hash-node-to-signed-fit-images-12ab0c9271ce
Best regards,
--
Jonas Juffinger <jonas.juffinger@liebherr.com>
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [OE-core] [PATCH] kernel-fit-image: Don't add hash node when signing is enabled
2026-08-19 8:21 ` jonas.juffinger
(?)
@ 2026-08-20 18:23 ` Mathieu Dubois-Briand
-1 siblings, 0 replies; 3+ messages in thread
From: Mathieu Dubois-Briand @ 2026-08-20 18:23 UTC (permalink / raw)
To: jonas.juffinger, openembedded-core
On Wed Aug 19, 2026 at 10:21 AM CEST, Jonas Juffinger via B4 Relay via lists.openembedded.org wrote:
> From: Jonas Juffinger <jonas.juffinger@liebherr.com>
>
> When configuration signing is enabled, mkimage does not fill
> the hash node even if it present. This causes the verification
> to fail with a "Bad Data Hash' error because the hash exists
> but it empty.
>
> This patch adds a check to only add the hash node if signing
> is not enabled.
>
> The example FIT from the official documentation also shows
> the configuration field with only the signature, without the
> hash field:
> https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations
>
> Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
> ---
Hi Jonas,
Thanks for your patch.
I believe this is breaking some selftests:
2026-08-20 12:42:24,754 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase)
2026-08-20 12:42:24,755 - oe-selftest - INFO - ... FAIL
...
2026-08-20 12:42:24,755 - oe-selftest - INFO - 13: 7/33 386/767 (109.78s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs)
2026-08-20 12:42:24,755 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1412, in test_fit_image_sign_initramfs
self._test_fitimage(bb_vars)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 656, in _test_fitimage
self._check_its_file(bb_vars, fitimage_its_path)
~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 538, in _check_its_file
self.fail('Missing path in its file: %s (%s)' % (req_path, its_file_path))
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/buildtools/sysroots/x86_64-pokysdk-linux/usr/lib/python3.13/unittest/case.py", line 732, in fail
raise self.failureException(msg)
AssertionError: Missing path in its file: ['/', 'configurations', 'conf-1', 'hash-1'] (/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/build-st-669766/tmp/deploy/images/qemux86-64/fit-image.its)
...
2026-08-20 12:46:30,607 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs_bundle (subunit.RemotedTestCase)
2026-08-20 12:46:30,608 - oe-selftest - INFO - ... FAIL
...
2026-08-20 12:48:03,259 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_sign_fit_image_configurations (subunit.RemotedTestCase)
2026-08-20 12:48:03,260 - oe-selftest - INFO - ... FAIL
...
2026-08-20 12:48:58,824 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_sign_fit_image_individual (subunit.RemotedTestCase)
2026-08-20 12:48:58,824 - oe-selftest - INFO - ... FAIL
...
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4439
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4614
https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4664
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 3+ messages in thread