Hi Daniel, On Tue, 28 Jul 2026 at 12:53, Daniel Golle <[email protected]> wrote: > > On Tue, Jul 28, 2026 at 12:45:38PM -0600, Simon Glass wrote: > > Hi Daniel, > > > > On 2026-07-21T02:34:47, Daniel Golle <[email protected]> wrote: > > > > > v3: address comments by Simon Glass > > > > Thanks for the rework - the doc additions in signature.rst and > > dm-verity.rst read well, and the test fix is a good catch. > > > > I still think we should state the compatibility break explicitly > > somehow: because U-Boot rebuilds the node list rather than trusting > > hashed-nodes, an image signed by an older mkimage that carries a > > dm-verity subnode stops verifying under this fix, and an image signed > > by the new mkimage does not verify on an older U-Boot. > > > > The new language in dm-verity.rst documents the security property (the > > roothash can no longer be swapped out), but it doesn't warn that > > deployed images must be re-signed after upgrading and that mixed > > old/new fleets need care. > > > > The break is unavoidable I think and I may be overthinking all this, > > but it would be nice to avoid people getting confused. > > Technically you are right, there could be, but I strongly believe > there aren't any "deployments" of this right now. > > The whole mechanism is built in order to be deployed as part of the > **upcoming** OpenWrt bootstd method. As of today, there aren't > currently any deployments using dm-verity on OpenWrt with this > mechanism (apart from some boards on my desk at least, and people > who have tried the PoC[1] -- which is/was a PoC and obviously subject > to changes as part of upstream review and standartization)
OK I see...and you would know :-) So that's fine, thanks. Regards, Simon > > [1]: https://github.com/openwrt/openwrt/pull/22177
