* [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations
@ 2026-10-08 6:09 Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
0 siblings, 2 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
The SPL FIT signing path was signing individual images, but not the configuration.
Introduce signing of configuration with images under a separate option SPL_SIGN_CONF.
For now it is disabled. Enabling this option implies changes in the DTB content.
The old behaviour is possible with SPL_SIGN_INDIVIDUAL, but should be removed in
a subsequent patch.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/classes-recipe/uboot-sign.bbclass | 86 ++++++++++++++++++++++++--
1 file changed, 82 insertions(+), 4 deletions(-)
diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 236d19925e..42319d15ff 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -33,6 +33,16 @@ UBOOT_FITIMAGE_ENABLE ?= "0"
# Signature activation - this requires UBOOT_FITIMAGE_ENABLE = "1"
SPL_SIGN_ENABLE ?= "0"
+# Sign the FIT configuration in the SPL signing flow. Configuration
+# signatures bind the selected images and boot metadata together.
+SPL_SIGN_CONF ?= "0"
+
+# Legacy compatibility knob for per-image signatures in the SPL FIT path.
+# Individual image signatures do not protect the configuration metadata
+# which selects and parameterizes the boot images.
+# INSECURE, use at your own risk
+SPL_SIGN_INDIVIDUAL ?= "1"
+
# Default value for deployment filenames.
UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
UBOOT_DTB_BINARY ?= "u-boot.dtb"
@@ -327,7 +337,15 @@ uboot_fitimage_atf() {
entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>;
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -354,7 +372,15 @@ uboot_fitimage_tee() {
entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>;
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -395,7 +421,15 @@ uboot_fitimage_assemble() {
entry = <${UBOOT_FIT_UBOOT_ENTRYPOINT}>;
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -414,7 +448,15 @@ EOF
compression = "none";
EOF
- if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ hash-1 {
+ algo = "${UBOOT_FIT_HASH_ALG}";
+ };
+EOF
+ fi
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
@@ -447,9 +489,20 @@ EOF
conf_loadables="${conf_loadables}${UBOOT_FIT_CONF_USER_LOADABLES}"
fi
+ conf_sign_images=""
+ conf_sign_images_sep=""
+
if [ -n "${UBOOT_FIT_CONF_FIRMWARE}" ] ; then
conf_firmware="firmware = \"${UBOOT_FIT_CONF_FIRMWARE}\";"
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"firmware\""
+ conf_sign_images_sep=", "
+ fi
+
+ if [ -n "${conf_loadables}" ] ; then
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"loadables\""
+ conf_sign_images_sep=", "
fi
+ conf_sign_images="${conf_sign_images}${conf_sign_images_sep}\"fdt\""
cat << EOF >> ${UBOOT_ITS}
};
@@ -461,6 +514,19 @@ EOF
${conf_firmware}
loadables = ${conf_loadables};
fdt = "fdt";
+EOF
+
+ if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${SPL_SIGN_CONF}" = "1" ] ; then
+ cat << EOF >> ${UBOOT_ITS}
+ signature {
+ algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
+ key-name-hint = "${SPL_SIGN_KEYNAME}";
+ sign-images = ${conf_sign_images};
+ };
+EOF
+ fi
+
+ cat << EOF >> ${UBOOT_ITS}
};
};
};
@@ -475,6 +541,18 @@ EOF
${UBOOT_FITIMAGE_BINARY}
if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+ if [ "${SPL_SIGN_CONF}" != "1" ] && [ "${SPL_SIGN_INDIVIDUAL}" != "1" ] ; then
+ bbfatal "SPL_SIGN_ENABLE=1 requires SPL_SIGN_CONF=1 or SPL_SIGN_INDIVIDUAL=1"
+ fi
+
+ if [ "${SPL_SIGN_CONF}" != "1" ] ; then
+ bbwarn "SPL_SIGN_CONF is disabled. FIT configuration signing is recommended for SPL verified boot."
+ fi
+
+ if [ "${SPL_SIGN_INDIVIDUAL}" = "1" ] ; then
+ bbwarn "SPL_SIGN_INDIVIDUAL=1 is enabled for compatibility only. It is INSECURE. Individual image signatures do not replace configuration signing."
+ fi
+
if [ -n "${SPL_DTB_BINARY}" ] ; then
#
# Sign the U-boot FIT image and add public key to SPL dtb.
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
@ 2026-10-08 6:09 ` Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
1 sibling, 2 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
Modify testcases after adding signing of a configuration of uboot instead
of various sections separately.
This change includes an additional parameter to _check_signing that allows
more flexible configuration and avoids assumptions on what section has,
and which section does not have a signature - now they are defined
in a data structure.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++---------
1 file changed, 34 insertions(+), 19 deletions(-)
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index 5d77e6da09..b95e6c158c 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase):
self._is_req_dict_in_dict(sections, req_sections)
# Call the signing related checks if the function is provided by a inherited class
- self._check_signing(bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path)
+ self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path)
def _get_req_its_paths(self, bb_vars):
self.logger.error("This function needs to be implemented")
@@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase):
self.logger.error("This function needs to be implemented")
return ({}, 0)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
"""Verify the signatures in the FIT image."""
self.fail("Function needs to be implemented by inheriting classes")
@@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase):
req_sections[section]['Hash algo'] = fit_hash_alg
return (req_sections, num_signatures)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
"""Verify the signature nodes in the FIT image"""
if bb_vars['UBOOT_SIGN_ENABLE'] == "1":
self.logger.debug("Verifying signatures in the FIT image")
@@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase):
for section, values in sections.items():
# Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
if section.startswith(bb_vars['FIT_CONF_PREFIX']):
+ if 'Sign algo' not in req_values[section]:
+ continue
sign_algo = values.get('Sign algo', None)
req_sign_algo = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname)
self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
@@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase):
'SPL_MKIMAGE_SIGN_ARGS',
'SPL_SIGN_ENABLE',
'SPL_SIGN_KEYNAME',
+ 'SPL_SIGN_INDIVIDUAL',
+ 'SPL_SIGN_CONF',
'TOPDIR',
'UBOOT_ARCH',
'UBOOT_DTB_BINARY',
@@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase):
req_its_paths = []
for image in images:
req_its_paths.append(['/', 'images', image])
- if bb_vars['SPL_SIGN_ENABLE'] == "1":
+ if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_INDIVIDUAL'] == "1":
req_its_paths.append(['/', 'images', image, 'signature'])
+ elif bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1":
+ req_its_paths.append(['/', 'images', image, 'hash-1'])
for configuration in configurations:
req_its_paths.append(['/', 'configurations', configuration])
+ if bb_vars['SPL_SIGN_ENABLE'] == "1" and bb_vars['SPL_SIGN_CONF'] == "1":
+ req_its_paths.append(['/', 'configurations', 'conf', 'signature'])
return (req_its_paths, [])
def _get_req_its_fields(self, bb_vars):
@@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase):
uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG']
spl_sign_enable = bb_vars['SPL_SIGN_ENABLE']
spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME']
+ spl_sign_conf = bb_vars['SPL_SIGN_CONF']
+ spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL']
num_signatures = 0
if spl_sign_enable == "1":
for section in req_sections:
- if not section.startswith('conf'):
- req_sections[section]['Sign algo'] = "%s,%s:%s" % \
- (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
- num_signatures += 1
+ if section.startswith('conf'):
+ if spl_sign_conf == "1":
+ req_sections[section]['Sign algo'] = "%s,%s:%s" % \
+ (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ num_signatures += 1
+ else:
+ if spl_sign_conf == "1":
+ req_sections[section]['Hash algo'] = uboot_fit_hash_alg
+ elif spl_sign_individual == "1":
+ req_sections[section]['Sign algo'] = "%s,%s:%s" % \
+ (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ num_signatures += 1
return (req_sections, num_signatures)
- def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path):
+ def _check_signing(self, bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path):
if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and bb_vars['SPL_SIGN_ENABLE'] == "1":
self.logger.debug("Verifying signatures in the FIT image")
else:
@@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase):
fit_sign_alg_len = FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg]
for section, values in sections.items():
# Configuration nodes are always signed with UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
- if section.startswith("conf"):
- # uboot-sign does not sign configuration nodes
- pass
- else:
- # uboot-sign does not add hash nodes, only image signatures
- sign_algo = values.get('Sign algo', None)
- req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
- self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
- sign_value = values.get('Sign value', None)
- self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section)
+ if 'Sign algo' not in req_sections[section]:
+ continue
+ sign_algo = values.get('Sign algo', None)
+ req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg, uboot_fit_sign_alg, spl_sign_keyname)
+ self.assertEqual(sign_algo, req_sign_algo, 'Signature algorithm for %s not expected value' % section)
+ sign_value = values.get('Sign value', None)
+ self.assertEqual(len(sign_value), fit_sign_alg_len, 'Signature value for section %s not expected length' % section)
# Search for the string passed to mkimage in each signed section of the FIT image.
# Looks like mkimage supports to add a comment but does not support to read it back.
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
@ 2026-10-08 6:09 ` Marta Rybczynska
1 sibling, 0 replies; 5+ messages in thread
From: Marta Rybczynska @ 2026-10-08 6:09 UTC (permalink / raw)
To: openembedded-core; +Cc: a.fatoum, adrian.freihofer, Marta Rybczynska
This commit enables signing SPL FIT configuration instead of specific
elements. This introduces an incompatibility with the previous behavior,
but is the correct way to do.
Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
---
meta/classes-recipe/uboot-sign.bbclass | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 42319d15ff..85138bc948 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -35,13 +35,13 @@ SPL_SIGN_ENABLE ?= "0"
# Sign the FIT configuration in the SPL signing flow. Configuration
# signatures bind the selected images and boot metadata together.
-SPL_SIGN_CONF ?= "0"
+SPL_SIGN_CONF ?= "1"
# Legacy compatibility knob for per-image signatures in the SPL FIT path.
# Individual image signatures do not protect the configuration metadata
# which selects and parameterizes the boot images.
# INSECURE, use at your own risk
-SPL_SIGN_INDIVIDUAL ?= "1"
+SPL_SIGN_INDIVIDUAL ?= "0"
# Default value for deployment filenames.
UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
@ 2026-10-09 9:13 ` Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
1 sibling, 0 replies; 5+ messages in thread
From: Mathieu Dubois-Briand @ 2026-10-09 9:13 UTC (permalink / raw)
To: rybczynska, openembedded-core; +Cc: a.fatoum, adrian.freihofer
On Thu Oct 8, 2026 at 8:09 AM CEST, Marta Rybczynska via lists.openembedded.org wrote:
> Modify testcases after adding signing of a configuration of uboot instead
> of various sections separately.
>
> This change includes an additional parameter to _check_signing that allows
> more flexible configuration and avoids assumptions on what section has,
> and which section does not have a signature - now they are defined
> in a data structure.
>
> Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
> ---
Hi Marta,
Thanks for the new version.
It looks like the selftest is failing here:
2026-10-09 07:38:19,536 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase)
2026-10-09 07:38:19,536 - oe-selftest - INFO - ... ERROR
...
2026-10-09 07:38:19,537 - oe-selftest - INFO - 13: 7/35 462/773 (190.09s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs)
2026-10-09 07:38:19,537 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1414, in test_fit_image_sign_initramfs
self._test_fitimage(bb_vars)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 660, in _test_fitimage
self._check_fitimage(bb_vars, fitimage_path, uboot_tools_bindir)
~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 617, in _check_fitimage
self._check_signing(bb_vars, sections, req_sections, num_signatures, uboot_tools_bindir, fitimage_path)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1108, in _check_signing
if 'Sign algo' not in req_values[section]:
^^^^^^^^^^
NameError: name 'req_values' is not defined
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4842
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/5029
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
@ 2026-10-09 13:53 ` Freihofer, Adrian
1 sibling, 0 replies; 5+ messages in thread
From: Freihofer, Adrian @ 2026-10-09 13:53 UTC (permalink / raw)
To: Marta Rybczynska, openembedded-core@lists.openembedded.org
Cc: a.fatoum@pengutronix.de
On Thu, 2026-10-08 at 08:09 +0200, Marta Rybczynska wrote:
> Modify testcases after adding signing of a configuration of uboot
> instead
> of various sections separately.
>
> This change includes an additional parameter to _check_signing that
> allows
> more flexible configuration and avoids assumptions on what section
> has,
> and which section does not have a signature - now they are defined
> in a data structure.
>
> Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>
> ---
> meta/lib/oeqa/selftest/cases/fitimage.py | 53 +++++++++++++++-------
> --
> 1 file changed, 34 insertions(+), 19 deletions(-)
>
> diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py
> b/meta/lib/oeqa/selftest/cases/fitimage.py
> index 5d77e6da09..b95e6c158c 100644
> --- a/meta/lib/oeqa/selftest/cases/fitimage.py
> +++ b/meta/lib/oeqa/selftest/cases/fitimage.py
> @@ -614,7 +614,7 @@ class FitImageTestCase(OESelftestTestCase):
> self._is_req_dict_in_dict(sections, req_sections)
>
> # Call the signing related checks if the function is
> provided by a inherited class
> - self._check_signing(bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path)
> + self._check_signing(bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path)
>
> def _get_req_its_paths(self, bb_vars):
> self.logger.error("This function needs to be implemented")
> @@ -636,7 +636,7 @@ class FitImageTestCase(OESelftestTestCase):
> self.logger.error("This function needs to be implemented")
> return ({}, 0)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> """Verify the signatures in the FIT image."""
> self.fail("Function needs to be implemented by inheriting
> classes")
>
> @@ -1076,7 +1076,7 @@ class KernelFitImageBase(FitImageTestCase):
> req_sections[section]['Hash algo'] =
> fit_hash_alg
> return (req_sections, num_signatures)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> """Verify the signature nodes in the FIT image"""
> if bb_vars['UBOOT_SIGN_ENABLE'] == "1":
> self.logger.debug("Verifying signatures in the FIT
> image")
> @@ -1105,6 +1105,8 @@ class KernelFitImageBase(FitImageTestCase):
> for section, values in sections.items():
> # Configuration nodes are always signed with
> UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
> if section.startswith(bb_vars['FIT_CONF_PREFIX']):
> + if 'Sign algo' not in req_values[section]:
This should probably look like:
if 'Sign algo' not in req_sections[section]:
Thanks for the work on this series—overall it's shaping up nicely and
we should be able to get it ready to merge soon.
Regarding testing: I noticed the same bug was already flagged and
commented on in v3. Could we double-check how this was tested? Running
oe-selftest per commit would be really helpful here, especially to
prove that the first two commits are stable enough to backport to the
LTS branch later.
Regards,
Adrian
> + continue
> sign_algo = values.get('Sign algo', None)
> req_sign_algo = "%s,%s:%s" % (fit_hash_alg,
> fit_sign_alg, uboot_sign_keyname)
> self.assertEqual(sign_algo, req_sign_algo,
> 'Signature algorithm for %s not expected value' % section)
> @@ -1688,6 +1690,8 @@ class UBootFitImageTests(FitImageTestCase):
> 'SPL_MKIMAGE_SIGN_ARGS',
> 'SPL_SIGN_ENABLE',
> 'SPL_SIGN_KEYNAME',
> + 'SPL_SIGN_INDIVIDUAL',
> + 'SPL_SIGN_CONF',
> 'TOPDIR',
> 'UBOOT_ARCH',
> 'UBOOT_DTB_BINARY',
> @@ -1763,10 +1767,14 @@ class UBootFitImageTests(FitImageTestCase):
> req_its_paths = []
> for image in images:
> req_its_paths.append(['/', 'images', image])
> - if bb_vars['SPL_SIGN_ENABLE'] == "1":
> + if bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_INDIVIDUAL'] == "1":
> req_its_paths.append(['/', 'images', image,
> 'signature'])
> + elif bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_CONF'] == "1":
> + req_its_paths.append(['/', 'images', image, 'hash-
> 1'])
> for configuration in configurations:
> req_its_paths.append(['/', 'configurations',
> configuration])
> + if bb_vars['SPL_SIGN_ENABLE'] == "1" and
> bb_vars['SPL_SIGN_CONF'] == "1":
> + req_its_paths.append(['/', 'configurations', 'conf',
> 'signature'])
> return (req_its_paths, [])
>
> def _get_req_its_fields(self, bb_vars):
> @@ -1874,16 +1882,26 @@ class UBootFitImageTests(FitImageTestCase):
> uboot_fit_sign_alg = bb_vars['UBOOT_FIT_SIGN_ALG']
> spl_sign_enable = bb_vars['SPL_SIGN_ENABLE']
> spl_sign_keyname = bb_vars['SPL_SIGN_KEYNAME']
> + spl_sign_conf = bb_vars['SPL_SIGN_CONF']
> + spl_sign_individual = bb_vars['SPL_SIGN_INDIVIDUAL']
> num_signatures = 0
> if spl_sign_enable == "1":
> for section in req_sections:
> - if not section.startswith('conf'):
> - req_sections[section]['Sign algo'] = "%s,%s:%s"
> % \
> - (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> - num_signatures += 1
> + if section.startswith('conf'):
> + if spl_sign_conf == "1":
> + req_sections[section]['Sign algo'] =
> "%s,%s:%s" % \
> + (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> + num_signatures += 1
> + else:
> + if spl_sign_conf == "1":
> + req_sections[section]['Hash algo'] =
> uboot_fit_hash_alg
> + elif spl_sign_individual == "1":
> + req_sections[section]['Sign algo'] =
> "%s,%s:%s" % \
> + (uboot_fit_hash_alg, uboot_fit_sign_alg,
> spl_sign_keyname)
> + num_signatures += 1
> return (req_sections, num_signatures)
>
> - def _check_signing(self, bb_vars, sections, num_signatures,
> uboot_tools_bindir, fitimage_path):
> + def _check_signing(self, bb_vars, sections, req_sections,
> num_signatures, uboot_tools_bindir, fitimage_path):
> if bb_vars['UBOOT_FITIMAGE_ENABLE'] == '1' and
> bb_vars['SPL_SIGN_ENABLE'] == "1":
> self.logger.debug("Verifying signatures in the FIT
> image")
> else:
> @@ -1896,16 +1914,13 @@ class UBootFitImageTests(FitImageTestCase):
> fit_sign_alg_len =
> FitImageTestCase.MKIMAGE_SIGNATURE_LENGTHS[uboot_fit_sign_alg]
> for section, values in sections.items():
> # Configuration nodes are always signed with
> UBOOT_SIGN_KEYNAME (if UBOOT_SIGN_ENABLE = "1")
> - if section.startswith("conf"):
> - # uboot-sign does not sign configuration nodes
> - pass
> - else:
> - # uboot-sign does not add hash nodes, only image
> signatures
> - sign_algo = values.get('Sign algo', None)
> - req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg,
> uboot_fit_sign_alg, spl_sign_keyname)
> - self.assertEqual(sign_algo, req_sign_algo,
> 'Signature algorithm for %s not expected value' % section)
> - sign_value = values.get('Sign value', None)
> - self.assertEqual(len(sign_value), fit_sign_alg_len,
> 'Signature value for section %s not expected length' % section)
> + if 'Sign algo' not in req_sections[section]:
> + continue
> + sign_algo = values.get('Sign algo', None)
> + req_sign_algo = "%s,%s:%s" % (uboot_fit_hash_alg,
> uboot_fit_sign_alg, spl_sign_keyname)
> + self.assertEqual(sign_algo, req_sign_algo, 'Signature
> algorithm for %s not expected value' % section)
> + sign_value = values.get('Sign value', None)
> + self.assertEqual(len(sign_value), fit_sign_alg_len,
> 'Signature value for section %s not expected length' % section)
>
> # Search for the string passed to mkimage in each signed
> section of the FIT image.
> # Looks like mkimage supports to add a comment but does not
> support to read it back.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-09 13:53 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-08 6:09 [PATCH v4 1/3] uboot-sign: add the option to sign SPL FIT configurations Marta Rybczynska
2026-10-08 6:09 ` [PATCH v4 2/3] oe-selftest: fitimage: support new schema for uboot configuration signing Marta Rybczynska
2026-10-09 9:13 ` [OE-core] " Mathieu Dubois-Briand
2026-10-09 13:53 ` Freihofer, Adrian
2026-10-08 6:09 ` [PATCH v4 3/3] uboot-sign: enable signing SPL FIT configuration Marta Rybczynska
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox