This commit enables signing SPL FIT configuration instead of specific elements. This introduces an incompatibility with the previous behavior, but is the correct way to do.
Signed-off-by: Marta Rybczynska <[email protected]> --- meta/classes-recipe/uboot-sign.bbclass | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 42319d15ff..85138bc948 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -35,13 +35,13 @@ SPL_SIGN_ENABLE ?= "0" # Sign the FIT configuration in the SPL signing flow. Configuration # signatures bind the selected images and boot metadata together. -SPL_SIGN_CONF ?= "0" +SPL_SIGN_CONF ?= "1" # Legacy compatibility knob for per-image signatures in the SPL FIT path. # Individual image signatures do not protect the configuration metadata # which selects and parameterizes the boot images. # INSECURE, use at your own risk -SPL_SIGN_INDIVIDUAL ?= "1" +SPL_SIGN_INDIVIDUAL ?= "0" # Default value for deployment filenames. UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247415): https://lists.openembedded.org/g/openembedded-core/message/247415 Mute This Topic: https://lists.openembedded.org/mt/121651142/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
