[PATCH] kernel-fit-image: Don't add hash node when signing is enabled

[PATCH] kernel-fit-image: Don't add hash node when signing is enabled

[jonas.juffinger]

From: Jonas Juffinger <jonas.juffinger@liebherr.com>

When configuration signing is enabled, mkimage does not fill
the hash node even if it present. This causes the verification
to fail with a "Bad Data Hash' error because the hash exists
but it empty.

This patch adds a check to only add the hash node if signing
is not enabled.

The example FIT from the official documentation also shows
the configuration field with only the signature, without the
hash field:
https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations

Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
---
 meta/lib/oe/fitimage.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
index d4dacdd508..142a5d60f7 100644
--- a/meta/lib/oe/fitimage.py
+++ b/meta/lib/oe/fitimage.py
@@ -485,7 +485,7 @@ class ItsNodeRootKernel(ItsNode):
             f"{default_flag} {', '.join(conf_desc)}",
             opt_props=opt_props
         )
-        if self._hash_algo:
+        if self._hash_algo and not self._sign_enable:
             ItsNodeHash(
                 "hash-1",
                 conf_node,

---
base-commit: 6f7a806ece411ab32e4b1c08a0299400bdf3b588
change-id: 20260819-bugfix-dont-add-hash-node-to-signed-fit-images-12ab0c9271ce

Best regards,
-- 
Jonas Juffinger <jonas.juffinger@liebherr.com>

Re: [OE-core] [PATCH] kernel-fit-image: Don't add hash node when signing is enabled

[Mathieu Dubois-Briand]

On Wed Aug 19, 2026 at 10:21 AM CEST, Jonas Juffinger via B4 Relay via lists.openembedded.org wrote:
> From: Jonas Juffinger <jonas.juffinger@liebherr.com>
>
> When configuration signing is enabled, mkimage does not fill
> the hash node even if it present. This causes the verification
> to fail with a "Bad Data Hash' error because the hash exists
> but it empty.
>
> This patch adds a check to only add the hash node if signing
> is not enabled.
>
> The example FIT from the official documentation also shows
> the configuration field with only the signature, without the
> hash field:
> https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations
>
> Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
> ---

Hi Jonas,

Thanks for your patch.

I believe this is breaking some selftests:

2026-08-20 12:42:24,754 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs (subunit.RemotedTestCase)
2026-08-20 12:42:24,755 - oe-selftest - INFO -  ... FAIL
...
2026-08-20 12:42:24,755 - oe-selftest - INFO - 13: 7/33 386/767 (109.78s) (0 failed) (fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs)
2026-08-20 12:42:24,755 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
  File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 1412, in test_fit_image_sign_initramfs
    self._test_fitimage(bb_vars)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 656, in _test_fitimage
    self._check_its_file(bb_vars, fitimage_its_path)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/fitimage.py", line 538, in _check_its_file
    self.fail('Missing path in its file: %s (%s)' % (req_path, its_file_path))
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/buildtools/sysroots/x86_64-pokysdk-linux/usr/lib/python3.13/unittest/case.py", line 732, in fail
    raise self.failureException(msg)
AssertionError: Missing path in its file: ['/', 'configurations', 'conf-1', 'hash-1'] (/srv/pokybuild/yocto-worker/oe-selftest-fedora/build/build-st-669766/tmp/deploy/images/qemux86-64/fit-image.its)
...
2026-08-20 12:46:30,607 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_fit_image_sign_initramfs_bundle (subunit.RemotedTestCase)
2026-08-20 12:46:30,608 - oe-selftest - INFO -  ... FAIL
...
2026-08-20 12:48:03,259 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_sign_fit_image_configurations (subunit.RemotedTestCase)
2026-08-20 12:48:03,260 - oe-selftest - INFO -  ... FAIL
...
2026-08-20 12:48:58,824 - oe-selftest - INFO - fitimage.KernelFitImageRecipeTests.test_sign_fit_image_individual (subunit.RemotedTestCase)
2026-08-20 12:48:58,824 - oe-selftest - INFO -  ... FAIL
...

https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4439
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4614
https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4664

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com