Re: [OE-core] [PATCH v3] kernel-fitimage: make signing failure fatal

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Mon, Sep 02, 2024 at 06:13:06PM +0200, A. Sverdlin via lists.openembedded.org wrote:
> From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
> 
> mkimage doesn't fail if it is not able to sign FIT nodes.
> This may lead to unbootable images in secure boot configurations.
> Make signing failures fatal by parsing the mkimage output.
> 
> Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
> ---
> Changes in v3:
> - bbfatag_log -> bberror + bbfatal_log with relevant mkimage output snippets
> Changes in v2:
> - bbfatal -> bbfatal_log
> 
>  meta/classes-recipe/kernel-fitimage.bbclass | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes-recipe/kernel-fitimage.bbclass b/meta/classes-recipe/kernel-fitimage.bbclass
> index 67c98adb232..ccf848e643f 100644
> --- a/meta/classes-recipe/kernel-fitimage.bbclass
> +++ b/meta/classes-recipe/kernel-fitimage.bbclass
> @@ -753,11 +753,16 @@ fitimage_assemble() {
>  	# Step 8: Sign the image
>  	#
>  	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
> -		${UBOOT_MKIMAGE_SIGN} \
> +		output=$(${UBOOT_MKIMAGE_SIGN} \

Will this subshell return errors as before or is "set -e" propagated there?

>  			${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
>  			-F -k "${UBOOT_SIGN_KEYDIR}" \
>  			-r ${KERNEL_OUTPUT_DIR}/$2 \
> -			${UBOOT_MKIMAGE_SIGN_ARGS}
> +			${UBOOT_MKIMAGE_SIGN_ARGS})
> +		echo "$output"
> +		if err=$(echo "$output" | grep -C9 -E "Sign value:\s*unavailable"); then
> +			bberror "${UBOOT_MKIMAGE_SIGN} failed to provide signatures for these images:"
> +			bbfatal_log "\n$err"

Is the problem really in mkimage since it does not return errors when signing fails?

Cheers,

-Mikko