From: Adrian Freihofer <[email protected]> This is v5 of Marta's series: https://lists.openembedded.org/g/openembedded-core/message/247413
FIT verified boot is currently receiving a lot of public attention, e.g. CVE-2026-33243 and the talk "FIT Happens: How Secure Boot Wasn't" at OSS EU 2026: https://osselceu2026.sched.com/event/2RaWy/fit-happens-how-secure-boot-wasnt-ahmad-fatoum-pengutronix-ek Signing the configuration is the minimum U-Boot itself recommends, so I would like to get this merged rather than let it stall further. Further hardening can be done on top. Migration notes for users with SPL_SIGN_ENABLE = "1": - The FIT configuration is signed by default and the public key in the SPL DTB becomes required = "conf" instead of "image". - Custom images added via UBOOT_FIT_USER_SETTINGS which are referenced by the configuration need a hash node, otherwise mkimage cannot sign the configuration. - The old behavior is available with SPL_SIGN_CONF = "0" and SPL_SIGN_INDIVIDUAL = "1" but triggers a warning. A patch for yocto-docs documenting the new variables and the migration is needed as well. Changes in v5: - Patch 1: unchanged. - Patch 2: - Drop the hunk in KernelFitImageBase._check_signing which used the undefined variable req_values. This raised a NameError in all signed kernel FIT tests. With UBOOT_SIGN_ENABLE = "1" all kernel FIT configurations are signed, and unsigned kernel FIT images return early from _check_signing. So no check is needed. Fixes: https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ - Patch 3: new, enhances the selftest checks of patch 2: - Check the image signature and the image hash nodes independently and verify that the nodes of the disabled mode are absent from the its file. - Use the configuration name instead of a hard-coded "conf". - Verify the sign-images property of the configuration signature. - Verify the required, algo and key-name-hint properties of the public key in the deployed SPL DTB. - Patch 4: new, test for configuration signing (non-default). - Patch 5: commit message typo fix only. - Patch 6: new, the non-default test now covers image signing. Adrian Freihofer (3): oe-selftest: fitimage: check image vs. configuration signing oe-selftest: fitimage: test SPL FIT configuration signing oe-selftest: fitimage: test SPL FIT individual image signing Marta Rybczynska (3): uboot-sign: add the option to sign SPL FIT configurations oe-selftest: fitimage: support new schema for uboot configuration signing uboot-sign: enable signing SPL FIT configuration meta/classes-recipe/uboot-sign.bbclass | 86 ++++++++++++++- meta/lib/oeqa/selftest/cases/fitimage.py | 130 +++++++++++++++++++---- 2 files changed, 191 insertions(+), 25 deletions(-) -- 2.56.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248619): https://lists.openembedded.org/g/openembedded-core/message/248619 Mute This Topic: https://lists.openembedded.org/mt/121930798/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
