* [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations @ 2026-10-08 6:09 Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska 0 siblings, 2 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska The SPL FIT signing path was signing individual images, but not the configuration. Introduce signing of configuration with images under a separate option SPL_SIGN_CONF. For now it is disabled. Enabling this option implies changes in the DTB content. The old behaviour is possible with SPL_SIGN_INDIVIDUAL, but should be removed in a subsequent patch. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/classes-recipe/uboot-sign.bbclass | 86 ++++++++++++++++++++++++-- 1 file changed, 82 insertions(+), 4 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 236d19925e..42319d15ff 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -33,6 +33,16 @@ UBOOT_FITIMAGE_ENABLE ?= "0" # Signature activation - this requires UBOOT_FITIMAGE_ENABLE = "1" SPL_SIGN_ENABLE ?= "0" +# Sign the FIT configuration in the SPL signing flow. Configuration +# signatures bind the selected images and boot metadata together. +SPL_SIGN_CONF ?= "0" + +# Legacy compatibility knob for per-image signatures in the SPL FIT path. +# Individual image signatures do not protect the configuration metadata +# which selects and parameterizes the boot images. +# INSECURE, use at your own risk +SPL_SIGN_INDIVIDUAL ?= "1" + # Default value for deployment filenames. UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" UBOOT_DTB_BINARY ?= "u-boot.dtb" @@ -327,7 +337,15 @@ uboot_fitimage_atf() { entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>; compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -354,7 +372,15 @@ uboot_fitimage_tee() { entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>; compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -395,7 +421,15 @@ uboot_fitimage_assemble() { entry = <${UBOOT_FIT_UBOOT_ENTRYPOINT}>; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -414,7 +448,15 @@ EOF compression = "none"; EOF - if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + hash-1 { + algo = "${UBOOT_FIT_HASH_ALG}"; + }; +EOF + fi + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then cat << EOF >> ${UBOOT_ITS} signature { algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; @@ -447,9 +489,20 @@ EOF conf_loadables="${conf_loadables}${UBOOT_FIT_CONF_USER_LOADABLES}" fi + conf_sign_images="" + conf_sign_images_sep="" + if [ -n "${UBOOT_FIT_CONF_FIRMWARE}" ] ; then conf_firmware="firmware = \"${UBOOT_FIT_CONF_FIRMWARE}\";" + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"firmware\"" + conf_sign_images_sep=", " + fi + + if [ -n "${conf_loadables}" ] ; then + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"loadables\"" + conf_sign_images_sep=", " fi + conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"fdt\"" cat << EOF >> ${UBOOT_ITS} }; @@ -461,6 +514,19 @@ EOF ${conf_firmware} loadables = ${conf_loadables}; fdt = "fdt"; +EOF + + if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then + cat << EOF >> ${UBOOT_ITS} + signature { + algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}"; + key-name-hint = "${SPL_SIGN_KEYNAME}"; + sign-images = ${conf_sign_images}; + }; +EOF + fi + + cat << EOF >> ${UBOOT_ITS} }; }; }; @@ -475,6 +541,18 @@ EOF ${UBOOT_FITIMAGE_BINARY} if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then + if [ "${SPL_SIGN_CONF}" != "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" != "1" ] ; then + bbfatal "SPL_SIGN_ENABLE=1 requires SPL_SIGN_CONF=1 or SPL_SIGN_INDIVIDUAL=1" + fi + + if [ "${SPL_SIGN_CONF}" != "1" ] ; then + bbwarn "SPL_SIGN_CONF is disabled. FIT configuration signing is recommended for SPL verified boot." + fi + + if [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then + bbwarn "SPL_SIGN_INDIVIDUAL=1 is enabled for compatibility only. It is INSECURE. Individual image signatures do not replace configuration signing." + fi + if [ -n "${SPL_DTB_BINARY}" ] ; then # # Sign the U-boot FIT image and add public key to SPL dtb. -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska @ 2026-10-08 6:09 ` Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska 1 sibling, 2 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska Modify testcases after adding signing of a configuration of uboot instead of various sections separately. This change includes an additional parameter to _check_signing that allows more flexible configuration and avoids assumptions on what section has, and which section does not have a signature - now they are defined in a data structure. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++--------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index 5d77e6da09..b95e6c158c 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase): self._is_req_dict_in_dict(sections, req_sections) # Call the signing related checks if the function is provided by a inherited class - self._check_signing(bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path) + self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path) def _get_req_its_paths(self, bb_vars): self.logger.error("This function needs to be implemented") @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase): self.logger.error("This function needs to be implemented") return ({}, 0) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): """Verify the signatures in the FIT image.""" self.fail("Function needs to be implemented by inheriting classes") @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase): req_sections[section]['Hash algo'] = fit_hash_alg return (req_sections, num_signatures) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): """Verify the signature nodes in the FIT image""" if bb_vars['UBOOT_SIGN_ENABLE'] == "1": self.logger.debug("Verifying signatures in the FIT image") @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase): for section, values in sections.items(): # Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") if section.startswith(bb_vars['FIT_CONF_PREFIX']): + if 'Sign algo' not in req_values[section]: + continue sign_algo = values.get('Sign algo', None) req_sign_algo = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname) self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase): 'SPL_MKIMAGE_SIGN_ARGS', 'SPL_SIGN_ENABLE', 'SPL_SIGN_KEYNAME', + 'SPL_SIGN_INDIVIDUAL', + 'SPL_SIGN_CONF', 'TOPDIR', 'UBOOT_ARCH', 'UBOOT_DTB_BINARY', @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase): req_its_paths = [] for image in images: req_its_paths.append(['/', 'images', image]) - if bb_vars['SPL_SIGN_ENABLE'] == "1": + if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_INDIVIDUAL'] == "1": req_its_paths.append(['/', 'images', image, 'signature']) + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1": + req_its_paths.append(['/', 'images', image, 'hash-1']) for configuration in configurations: req_its_paths.append(['/', 'configurations', configuration]) + if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1": + req_its_paths.append(['/', 'configurations', 'conf', 'signature']) return (req_its_paths, []) def _get_req_its_fields(self, bb_vars): @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase): uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG'] spl_sign_enable = bb_vars['SPL_SIGN_ENABLE'] spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME'] + spl_sign_conf = bb_vars['SPL_SIGN_CONF'] + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL'] num_signatures = 0 if spl_sign_enable == "1": for section in req_sections: - if not section.startswith('conf'): - req_sections[section]['Sign algo'] = "%s,%s:%s" % \ - (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) - num_signatures += 1 + if section.startswith('conf'): + if spl_sign_conf == "1": + req_sections[section]['Sign algo'] = "%s,%s:%s" % \ + (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + num_signatures += 1 + else: + if spl_sign_conf == "1": + req_sections[section]['Hash algo'] = uboot_fit_hash_alg + elif spl_sign_individual == "1": + req_sections[section]['Sign algo'] = "%s,%s:%s" % \ + (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + num_signatures += 1 return (req_sections, num_signatures) - def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): + def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path): if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and bb_vars['SPL_SIGN_ENABLE'] == "1": self.logger.debug("Verifying signatures in the FIT image") else: @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase): fit_sign_alg_len = FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg] for section, values in sections.items(): # Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") - if section.startswith("conf"): - # uboot-sign does not sign configuration nodes - pass - else: - # uboot-sign does not add hash nodes, only image signatures - sign_algo = values.get('Sign algo', None) - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) - self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) - sign_value = values.get('Sign value', None) - self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section) + if 'Sign algo' not in req_sections[section]: + continue + sign_algo = values.get('Sign algo', None) + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname) + self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section) + sign_value = values.get('Sign value', None) + self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section) # Search for the string passed to mkimage in each signed section of the FIT image. # Looks like mkimage supports to add a comment but does not support to read it back. -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska @ 2026-10-09 9:13 ` Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 1 sibling, 0 replies; 5+ messages in thread From: Mathieu Dubois-Briand @ 2026-10-09 9:13 UTC (permalink / raw) To: rybczynska, openembedded-core; +Cc: a.fatoum, adrian.freihofer On Thu Oct 8, 2026 at 8:09 AM CEST, Marta Rybczynska via lists.openembedded.org wrote: > Modify testcases after adding signing of a configuration of uboot instead > of various sections separately. > > This change includes an additional parameter to _check_signing that allows > more flexible configuration and avoids assumptions on what section has, > and which section does not have a signature - now they are defined > in a data structure. > > Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> > --- Hi Marta, Thanks for the new version. It looks like the selftest is failing here: 2026-10-09 07:38:19,536 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase) 2026-10-09 07:38:19,536 - oe-selftest - INFO - ... ERROR ... 2026-10-09 07:38:19,537 - oe-selftest - INFO - 13: 7/35 462/773 (190.09s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs) 2026-10-09 07:38:19,537 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last): File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1414, in test_fit_image_sign_initramfs self._test_fitimage(bb_vars) ~~~~~~~~~~~~~~~~~~~^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 660, in _test_fitimage self._check_fitimage(bb_vars, fitimage_path, uboot_tools_bindir) ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 617, in _check_fitimage self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path) ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1108, in _check_signing if 'Sign algo' not in req_values[section]: ^^^^^^^^^^ NameError: name 'req_values' is not defined https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4842 https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/5029 Can you have a look at the issue? Thanks, Mathieu -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand @ 2026-10-09 13:53 ` Freihofer, Adrian 1 sibling, 0 replies; 5+ messages in thread From: Freihofer, Adrian @ 2026-10-09 13:53 UTC (permalink / raw) To: Marta Rybczynska, openembedded-core@lists.openembedded.org Cc: a.fatoum@pengutronix.de On Thu, 2026-10-08 at 08:09 +0200, Marta Rybczynska wrote: > Modify testcases after adding signing of a configuration of uboot > instead > of various sections separately. > > This change includes an additional parameter to _check_signing that > allows > more flexible configuration and avoids assumptions on what section > has, > and which section does not have a signature - now they are defined > in a data structure. > > Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> > --- > meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++------- > -- > 1 file changed, 34 insertions(+), 19 deletions(-) > > diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py > b/meta/lib/oeqa/selftest/cases/fitimage.py > index 5d77e6da09..b95e6c158c 100644 > --- a/meta/lib/oeqa/selftest/cases/fitimage.py > +++ b/meta/lib/oeqa/selftest/cases/fitimage.py > @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase): > self._is_req_dict_in_dict(sections, req_sections) > > # Call the signing related checks if the function is > provided by a inherited class > - self._check_signing(bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path) > + self._check_signing(bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path) > > def _get_req_its_paths(self, bb_vars): > self.logger.error("This function needs to be implemented") > @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase): > self.logger.error("This function needs to be implemented") > return ({}, 0) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > """Verify the signatures in the FIT image.""" > self.fail("Function needs to be implemented by inheriting > classes") > > @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase): > req_sections[section]['Hash algo'] = > fit_hash_alg > return (req_sections, num_signatures) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > """Verify the signature nodes in the FIT image""" > if bb_vars['UBOOT_SIGN_ENABLE'] == "1": > self.logger.debug("Verifying signatures in the FIT > image") > @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase): > for section, values in sections.items(): > # Configuration nodes are always signed with > UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") > if section.startswith(bb_vars['FIT_CONF_PREFIX']): > + if 'Sign algo' not in req_values[section]: This should probably look like: if 'Sign algo' not in req_sections[section]: Thanks for the work on this series—overall it's shaping up nicely and we should be able to get it ready to merge soon. Regarding testing: I noticed the same bug was already flagged and commented on in v3. Could we double-check how this was tested? Running oe-selftest per commit would be really helpful here, especially to prove that the first two commits are stable enough to backport to the LTS branch later. Regards, Adrian > + continue > sign_algo = values.get('Sign algo', None) > req_sign_algo = "%s,%s:%s" % (fit_hash_alg, > fit_sign_alg, uboot_sign_keyname) > self.assertEqual(sign_algo, req_sign_algo, > 'Signature algorithm for %s not expected value' % section) > @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase): > 'SPL_MKIMAGE_SIGN_ARGS', > 'SPL_SIGN_ENABLE', > 'SPL_SIGN_KEYNAME', > + 'SPL_SIGN_INDIVIDUAL', > + 'SPL_SIGN_CONF', > 'TOPDIR', > 'UBOOT_ARCH', > 'UBOOT_DTB_BINARY', > @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase): > req_its_paths = [] > for image in images: > req_its_paths.append(['/', 'images', image]) > - if bb_vars['SPL_SIGN_ENABLE'] == "1": > + if bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_INDIVIDUAL'] == "1": > req_its_paths.append(['/', 'images', image, > 'signature']) > + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_CONF'] == "1": > + req_its_paths.append(['/', 'images', image, 'hash- > 1']) > for configuration in configurations: > req_its_paths.append(['/', 'configurations', > configuration]) > + if bb_vars['SPL_SIGN_ENABLE'] == "1" and > bb_vars['SPL_SIGN_CONF'] == "1": > + req_its_paths.append(['/', 'configurations', 'conf', > 'signature']) > return (req_its_paths, []) > > def _get_req_its_fields(self, bb_vars): > @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase): > uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG'] > spl_sign_enable = bb_vars['SPL_SIGN_ENABLE'] > spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME'] > + spl_sign_conf = bb_vars['SPL_SIGN_CONF'] > + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL'] > num_signatures = 0 > if spl_sign_enable == "1": > for section in req_sections: > - if not section.startswith('conf'): > - req_sections[section]['Sign algo'] = "%s,%s:%s" > % \ > - (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > - num_signatures += 1 > + if section.startswith('conf'): > + if spl_sign_conf == "1": > + req_sections[section]['Sign algo'] = > "%s,%s:%s" % \ > + (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > + num_signatures += 1 > + else: > + if spl_sign_conf == "1": > + req_sections[section]['Hash algo'] = > uboot_fit_hash_alg > + elif spl_sign_individual == "1": > + req_sections[section]['Sign algo'] = > "%s,%s:%s" % \ > + (uboot_fit_hash_alg, uboot_fit_sign_alg, > spl_sign_keyname) > + num_signatures += 1 > return (req_sections, num_signatures) > > - def _check_signing(self, bb_vars, sections, num_signatures, > uboot_tools_bindir, fitimage_path): > + def _check_signing(self, bb_vars, sections, req_sections, > num_signatures, uboot_tools_bindir, fitimage_path): > if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and > bb_vars['SPL_SIGN_ENABLE'] == "1": > self.logger.debug("Verifying signatures in the FIT > image") > else: > @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase): > fit_sign_alg_len = > FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg] > for section, values in sections.items(): > # Configuration nodes are always signed with > UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1") > - if section.startswith("conf"): > - # uboot-sign does not sign configuration nodes > - pass > - else: > - # uboot-sign does not add hash nodes, only image > signatures > - sign_algo = values.get('Sign algo', None) > - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, > uboot_fit_sign_alg, spl_sign_keyname) > - self.assertEqual(sign_algo, req_sign_algo, > 'Signature algorithm for %s not expected value' % section) > - sign_value = values.get('Sign value', None) > - self.assertEqual(len(sign_value), fit_sign_alg_len, > 'Signature value for section %s not expected length' % section) > + if 'Sign algo' not in req_sections[section]: > + continue > + sign_algo = values.get('Sign algo', None) > + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, > uboot_fit_sign_alg, spl_sign_keyname) > + self.assertEqual(sign_algo, req_sign_algo, 'Signature > algorithm for %s not expected value' % section) > + sign_value = values.get('Sign value', None) > + self.assertEqual(len(sign_value), fit_sign_alg_len, > 'Signature value for section %s not expected length' % section) > > # Search for the string passed to mkimage in each signed > section of the FIT image. > # Looks like mkimage supports to add a comment but does not > support to read it back. ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska @ 2026-10-08 6:09 ` Marta Rybczynska 1 sibling, 0 replies; 5+ messages in thread From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw) To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska This commit enables signing SPL FIT configuration instead of specific elements. This introduces an incompatibility with the previous behavior, but is the correct way to do. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> --- meta/classes-recipe/uboot-sign.bbclass | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 42319d15ff..85138bc948 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -35,13 +35,13 @@ SPL_SIGN_ENABLE ?= "0" # Sign the FIT configuration in the SPL signing flow. Configuration # signatures bind the selected images and boot metadata together. -SPL_SIGN_CONF ?= "0" +SPL_SIGN_CONF ?= "1" # Legacy compatibility knob for per-image signatures in the SPL FIT path. # Individual image signatures do not protect the configuration metadata # which selects and parameterizes the boot images. # INSECURE, use at your own risk -SPL_SIGN_INDIVIDUAL ?= "1" +SPL_SIGN_INDIVIDUAL ?= "0" # Default value for deployment filenames. UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" -- 2.43.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-09 13:53 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska 2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska 2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand 2026-10-09 13:53 ` Freihofer, Adrian 2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox