Wed, Feb 04, 2026 at 02:28:53PM -0500, Raymond Mao wrote:
[snip]
When EFI_SECURE_BOOT is enabled, all these dependent Kconfigs will be
selected automatically.
I finally solved my problem by using "make menuconfig".
It turns out that CONFIG_FIT is not defined in rpi_4_defconfig. That is
why some requested configuration was being disregarded. The build
succeeds with the following:
cat > boot/rpi_4_ecdsa_defconfig << "EOF"
#include <configs/rpi_4_defconfig>
CONFIG_FIT=y
CONFIG_FIT_SIGNATURE=y
CONFIG_MBEDTLS_LIB=y
CONFIG_ECDSA=y
CONFIG_ECDSA_SW=y
CONFIG_ECDSA_VERIFY=y
CONFIG_EFI_SECURE_BOOT=y
CONFIG_EFI_LOADER=y
EOF
make rpi_4_ecdsa_defconfig
make -j$(nproc) CROSS_COMPILE=aarch64-linux-gnu-
I am yet to build an ECDSA signed fitImage of Linux and the device tree,
so I did not actually test this implementation yet.
With best regards,
Marko
