Re: [PATCH] u-boot: ensure keys are generated before assembling U-Boot FIT image

[Marek Vasut <marex@denx.de>]

On 5/9/25 11:37 PM, Rogerio Guerra Borin wrote:
> From: Rogerio Guerra Borin <rogerio.borin@toradex.com>
> 
> Add the task dependency:
> 
> do_uboot_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys
> 
> to ensure the kernel FIT image signing keys are available when creating
> the U-Boot DTB. This is done only if the signing of the kernel FIT image
> is enabled (UBOOT_SIGN_ENABLE="1").
> 
> The lack of the dependency causes build errors when executing a build
> with no kernel FIT keys initially present in the keys directory. In such
> cases one would see an output like this in the Bitbake logs:
> 
> Log data follows:
> | DEBUG: Executing shell function do_uboot_assemble_fitimage
> | Couldn't open RSA private key: '/workdir/build/keys/fit/dev.key': No such file or directory
> | Failed to sign 'signature' signature node in 'conf-1' conf node
> | FIT description: Kernel Image image with one or more FDT blobs
> | ...
> 
> This issue was introduced by commit 259bfa86f384 where the dependency
> between U-Boot and the kernel was removed (for good reasons). Before
> that commit the dependency was set via DEPENDS so that, in terms of
> tasks, one had:
> 
> u-boot:do_configure -> virtual/kernel:do_populate_sysroot
> 
> and the chain leading to the key generation was:
> 
> virtual/kernel:do_populate_sysroot -> virtual/kernel:do_install
> virtual/kernel:do_install -> virtual/kernel:do_assemble_fitimage
> virtual/kernel:do_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys
> 
> With the removal of the first dependency, no more guarantees exist that
> the keys would be present when assembling the U-Boot FIT image. That's
> the situation we are solving with the present commit.
> 
> Fixes: 259bfa86f384 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled")
> Signed-off-by: Rogerio Guerra Borin <rogerio.borin@toradex.com>
> Cc: Marek Vasut <marex@denx.de>
> Cc: Sean Anderson <sean.anderson@seco.com>
> Cc: Adrian Freihofer <adrian.freihofer@siemens.com>
> ---
>   meta/classes-recipe/uboot-sign.bbclass | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
> index 76a81546e34..7744e0c5ab5 100644
> --- a/meta/classes-recipe/uboot-sign.bbclass
> +++ b/meta/classes-recipe/uboot-sign.bbclass
> @@ -113,6 +113,8 @@ python() {
>       sign = d.getVar('UBOOT_SIGN_ENABLE') == '1'
>       if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1' or sign:
>           d.appendVar('DEPENDS', " u-boot-tools-native dtc-native")
> +    if sign:
> +        d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' virtual/kernel:do_kernel_generate_rsa_keys')
This should also check for FIT_GENERATE_KEYS=1 before adding the 
dependency, right ?