[PATCH v2] image-fit-sig: bind a required image key to its own verification

[PATCH v2] image-fit-sig: bind a required image key to its own verification

[anon87111]

fit_image_verify_required_sigs() passes each required key's node offset to
fit_image_verify_sig() as key_offset. That function never uses it: it calls
fit_image_check_sig() with required_keynode hardcoded to -1, which both
boot/image-fit-sig.c and include/image.h document as "any signature will
do". rsa_verify() then tries the key named by the FIT's own key-name-hint
and falls through to "try each of the keys in turn", so every required-key
iteration is satisfied by any signature that verifies under any key in the
control FDT.

With two or more keys marked required = "image", one signature from any one
of them satisfies the whole policy and the others contribute nothing.
doc/usage/fit/signature.rst says of "required": "this indicates that the
key must be verified for the image / configuration to be considered valid."

The configuration path is correct: fit_config_verify_key() passes
key_offset through to fit_config_check_sig().

On sandbox, with key-dev and key-prod both required = "image" and a FIT
carrying only a dev signature:

  Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
  sandbox: continuing, as we cannot run Linux

The doubled "dev+" is one signature satisfying both iterations, including
the one for key-prod. The same case against the configuration gate refuses:

  Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev-  error!
  Failed to verify required signature 'key-prod'

Nothing exercises this path: there is no required = "image" anywhere in the
tree, and test_required_key() builds only sign-configs-* fixtures.

Fixes: 56518e71041f ("image: Support signing of images")
Signed-off-by: anon87111 <anon87111@gmail.com>
---
Changes in v2:
- add a Fixes tag (Yao Zi)
- move the relationship to the other in-flight FIT series below the line,
  and trim the commit message generally (Yao Zi)

Separate from, and complementary to, the fail-open gate in "[PATCH 0/2]
image-fit-sig: close the image-signature fail-open gate" — that one is a
control FDT with no /signature node at all, this one is two required keys
and one signature satisfying both. Neither fix covers the other. Also
separate from "[PATCH v10 0/7] Improve FIT signature handling" [1], which
is the configuration gate.

A test needs a sign-images-*-prod.its fixture and an image variant of
test_required_key(); happy to send that once v10 settles, since it
refactors run_bootm().

[1] https://lore.kernel.org/u-boot/20260923114940.349985-1-ludwig.nussel@siemens.com/

 boot/image-fit-sig.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
index c0fbe81b4..d6c61e104 100644
--- a/boot/image-fit-sig.c
+++ b/boot/image-fit-sig.c
@@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int image_noffset,
 		if (!strncmp(name, FIT_SIG_NODENAME,
 			     strlen(FIT_SIG_NODENAME))) {
 			ret = fit_image_check_sig(fit, noffset, data, size,
-						  key_blob, -1, &err_msg);
+						  key_blob, key_offset,
+						  &err_msg);
 			if (ret) {
 				puts("- ");
 			} else {
-- 
2.43.0