From: Jonas Juffinger <[email protected]> When fit image signing is enabled, mkimage does not fill the configuration hash node even if it is present. This causes the verification to fail in U-Boot with a "Bad Data Hash" error because the hash node exists but is empty.
This patch adds a check to only add the configuration hash node if signing is not enabled and fixes the respective test cases. The example FIT from the official documentation also shows the configuration field with only the signature, without the hash field: https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations To further ensure that this change is valid, I also checked the U-Boot source for the hash and signature generation code: https://github.com/u-boot/u-boot/blob/main/tools/image-host.c#L1593 The function fit_config_add_verification_data only adds the signature and no hash. Compare with fit_image_add_verification_data which adds both. Signed-off-by: Jonas Juffinger <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (cherry picked from commit 7346ffe190482ee4932728ba8d8741be8bed1d5b) Signed-off-by: Denys Dmytriyenko <[email protected]> --- meta/lib/oe/fitimage.py | 2 +- meta/lib/oeqa/selftest/cases/fitimage.py | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py index d7e21171ab..a1040181a2 100644 --- a/meta/lib/oe/fitimage.py +++ b/meta/lib/oe/fitimage.py @@ -480,7 +480,7 @@ class ItsNodeRootKernel(ItsNode): f"{default_flag} {', '.join(conf_desc)}", opt_props=opt_props ) - if self._hash_algo: + if self._hash_algo and not self._sign_enable: ItsNodeHash( "hash-1", conf_node, diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index b35dda6674..84e21346ab 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -627,9 +627,10 @@ class KernelFitImageBase(FitImageTestCase): if uboot_sign_enable == "1" and fit_sign_individual == "1": req_its_paths.append(['/', 'images', image, 'signature-1']) for configuration in configurations: - req_its_paths.append(['/', 'configurations', configuration, 'hash-1']) if uboot_sign_enable == "1": req_its_paths.append(['/', 'configurations', configuration, 'signature-1']) + else: + req_its_paths.append(['/', 'configurations', configuration, 'hash-1']) not_req_its_paths = [] for image in not_images: @@ -792,14 +793,15 @@ class KernelFitImageBase(FitImageTestCase): # Add signing related properties if needed if uboot_sign_enable == "1": for section in req_sections: - req_sections[section]['Hash algo'] = fit_hash_alg if section.startswith(bb_vars['FIT_CONF_PREFIX']): - req_sections[section]['Hash value'] = "unavailable" req_sections[section]['Sign algo'] = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_keyname) num_signatures += 1 elif fit_sign_individual == "1": + req_sections[section]['Hash algo'] = fit_hash_alg req_sections[section]['Sign algo'] = "%s,%s:%s" % (fit_hash_alg, fit_sign_alg, uboot_sign_img_keyname) num_signatures += 1 + else: + req_sections[section]['Hash algo'] = fit_hash_alg return (req_sections, num_signatures) def _check_signing(self, bb_vars, sections, num_signatures, uboot_tools_bindir, fitimage_path): -- 2.35.3
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245862): https://lists.openembedded.org/g/openembedded-core/message/245862 Mute This Topic: https://lists.openembedded.org/mt/121263592/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
