[PATCH v2] image-fit-sig: bind a required image key to its own verification

[PATCH v2] image-fit-sig: bind a required image key to its own verification

[anon87111]

fit_image_verify_required_sigs() passes each required key's node offset to
fit_image_verify_sig() as key_offset. That function never uses it: it calls
fit_image_check_sig() with required_keynode hardcoded to -1, which both
boot/image-fit-sig.c and include/image.h document as "any signature will
do". rsa_verify() then tries the key named by the FIT's own key-name-hint
and falls through to "try each of the keys in turn", so every required-key
iteration is satisfied by any signature that verifies under any key in the
control FDT.

With two or more keys marked required = "image", one signature from any one
of them satisfies the whole policy and the others contribute nothing.
doc/usage/fit/signature.rst says of "required": "this indicates that the
key must be verified for the image / configuration to be considered valid."

The configuration path is correct: fit_config_verify_key() passes
key_offset through to fit_config_check_sig().

On sandbox, with key-dev and key-prod both required = "image" and a FIT
carrying only a dev signature:

  Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
  sandbox: continuing, as we cannot run Linux

The doubled "dev+" is one signature satisfying both iterations, including
the one for key-prod. The same case against the configuration gate refuses:

  Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev-  error!
  Failed to verify required signature 'key-prod'

Nothing exercises this path: there is no required = "image" anywhere in the
tree, and test_required_key() builds only sign-configs-* fixtures.

Fixes: 56518e71041f ("image: Support signing of images")
Signed-off-by: anon87111 <anon87111@gmail.com>
---
Changes in v2:
- add a Fixes tag (Yao Zi)
- move the relationship to the other in-flight FIT series below the line,
  and trim the commit message generally (Yao Zi)

Separate from, and complementary to, the fail-open gate in "[PATCH 0/2]
image-fit-sig: close the image-signature fail-open gate" — that one is a
control FDT with no /signature node at all, this one is two required keys
and one signature satisfying both. Neither fix covers the other. Also
separate from "[PATCH v10 0/7] Improve FIT signature handling" [1], which
is the configuration gate.

A test needs a sign-images-*-prod.its fixture and an image variant of
test_required_key(); happy to send that once v10 settles, since it
refactors run_bootm().

[1] https://lore.kernel.org/u-boot/20260923114940.349985-1-ludwig.nussel@siemens.com/

 boot/image-fit-sig.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
index c0fbe81b4..d6c61e104 100644
--- a/boot/image-fit-sig.c
+++ b/boot/image-fit-sig.c
@@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int image_noffset,
 		if (!strncmp(name, FIT_SIG_NODENAME,
 			     strlen(FIT_SIG_NODENAME))) {
 			ret = fit_image_check_sig(fit, noffset, data, size,
-						  key_blob, -1, &err_msg);
+						  key_blob, key_offset,
+						  &err_msg);
 			if (ret) {
 				puts("- ");
 			} else {
-- 
2.43.0

Re: [PATCH v2] image-fit-sig: bind a required image key to its own verification

[Simon Glass]

Hi,

On 2026-10-15T03:56:30, anon87111 <anon87111@gmail.com> wrote:
> image-fit-sig: bind a required image key to its own verification
>
> fit_image_verify_required_sigs() passes each required key's node offset to
> fit_image_verify_sig() as key_offset. That function never uses it: it calls
> fit_image_check_sig() with required_keynode hardcoded to -1, which both
> boot/image-fit-sig.c and include/image.h document as "any signature will
> do". rsa_verify() then tries the key named by the FIT's own key-name-hint
> and falls through to "try each of the keys in turn", so every required-key
> iteration is satisfied by any signature that verifies under any key in the
> control FDT.
>
> With two or more keys marked required = "image", one signature from any one
> of them satisfies the whole policy and the others contribute nothing.
> doc/usage/fit/signature.rst says of "required": "this indicates that the
> key must be verified for the image / configuration to be considered valid."
>
> The configuration path is correct: fit_config_verify_key() passes
> key_offset through to fit_config_check_sig().
>
> On sandbox, with key-dev and key-prod both required = "image" and a FIT
> carrying only a dev signature:
>
>   Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
>   sandbox: continuing, as we cannot run Linux
>
> The doubled "dev+" is one signature satisfying both iterations, including
> the one for key-prod. The same case against the configuration gate refuses:
>
>   Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev-  error!
>   Failed to verify required signature 'key-prod'
>
> Nothing exercises this path: there is no required = "image" anywhere in the
> tree, and test_required_key() builds only sign-configs-* fixtures.
>
> Fixes: 56518e71041f ("image: Support signing of images")
> Signed-off-by: anon87111 <anon87111@gmail.com>

Are you wanting to be anonymous?

>
>  boot/image-fit-sig.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

> diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
> @@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int image_noffset,
>  		if (!strncmp(name, FIT_SIG_NODENAME,
>  			     strlen(FIT_SIG_NODENAME))) {
>  			ret = fit_image_check_sig(fit, noffset, data, size,
> -						  key_blob, -1, &err_msg);
> +						  key_blob, key_offset,
> +						  &err_msg);

Nice catch. Two things worth doing as part of this series:

1. fit_image_verify_required_sigs() has no 'required-mode' handling,
unlike fit_config_verify_required_keys(). After this fix the image
path is strictly 'all', with no way to express 'any'. It would be
worth mirroring the config path so the two gates behave consistently.

2. A regression test using the existing sign-images-*.its fixtures,
parallel to test_required_key() in test/py/tests/test_vboot.py, would
stop this rotting again. Given the fault was invisible for years
precisely because nothing exercised the path, I'd lean towards
including it here.

What do you think?

Regards,
Simon