On 2026-07-28T16:18:39, James Hilliard <[email protected]> wrote: > tools: fit: sign all config image references > > Target-side configuration verification builds the signed-region list from > every image-reference property in the selected configuration. Host-side > signing still uses either the signature node sign-images property or the > legacy kernel/fdt/script default list. > > This lets mkimage generate configuration signatures which U-Boot cannot > verify when the configuration references other image types, such as > firmware, loadables or ramdisk entries. It also lets the host and target > disagree when sign-images names only a subset of the configuration images. > > Build the host-side signing list from the configuration properties in the > same way as target-side verification. Use one shared property classifier so > the host and target cannot drift apart again. This makes signed > configurations cover the root node, the configuration node, every > referenced image node, and its hash/cipher subnodes, regardless of image > type. > > Warn when a legacy sign-images property is present, since it no longer > limits the signed image list. Require every referenced image to have at > least one hash subnode. Add sandbox coverage proving that a firmware > reference omitted from sign-images is still recorded in hashed-nodes and > verified. > > Update the signed-configuration documentation to describe the same rule and > the hash-subnode requirement. > > Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed > node list") > Signed-off-by: James Hilliard <[email protected]> > > boot/image-fit-sig.c | 9 +-- > boot/image-fit.c | 17 +++++ > doc/board/ti/k3.rst | 10 ++- > doc/usage/fit/beaglebone_vboot.rst | 5 +- > doc/usage/fit/sign-configs.rst | 13 +++- > doc/usage/fit/signature.rst | 26 +++---- > doc/usage/fit/uefi.rst | 2 - > include/image.h | 9 +++ > test/py/tests/test_vboot.py | 11 ++- > test/py/tests/vboot/sign-configs-algo-arg.its | 1 - > test/py/tests/vboot/sign-configs-sha1-pss.its | 1 - > test/py/tests/vboot/sign-configs-sha1.its | 11 +++ > .../tests/vboot/sign-configs-sha256-pss-prod.its | 1 - > test/py/tests/vboot/sign-configs-sha256-pss.its | 1 - > test/py/tests/vboot/sign-configs-sha256.its | 1 - > test/py/tests/vboot/sign-configs-sha384.its | 1 - > tools/fit_image.c | 12 ++-- > tools/image-host.c | 84 > +++++++++------------- > 18 files changed, 121 insertions(+), 94 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
