fit_image_verify_required_sigs() returns success when the control devicetree has no /signature node, so a FIT with absent or invalid signatures verifies. The only indication is a compiled-out debug(). Reported on 2026-09-08 [1].
Patch 1 adds CONFIG_FIT_REQUIRE_CONFIG_SIGS handling to the image gate, patch 2 adds test/py coverage for the missing-node case. The configuration gate has the same early return and is already covered by Ludwig Nussel's series [2], now at v8, which only touches fit_config_verify_required_keys(). This is complementary and reuses Ludwig's Kconfig symbol. Default n, and the message is conditional on it: enabling enforcement breaks 13 of 32 test_vboot cases that assert the old contract, and Rockchip has no /signature node by design [3]. Tested on sandbox only. [1] https://lore.kernel.org/u-boot/CA+pz=k+hAU5dqbO4GOLJ0fRMRdyrq=ktsnwuc0ocr3r9pot...@mail.gmail.com/ [2] https://lore.kernel.org/u-boot/20260618144742.v7.4.6d1d5d14140677a76a7cd7bb99a9088d8c8f480c@changeid/ [3] https://lore.kernel.org/u-boot/[email protected]/ Changes in v2: - Shortened the cover letter; details moved into the patches. Eva Crystal (2): image-fit-sig: also require signatures on the image gate test: vboot: add coverage for a control FDT with no /signature node boot/Kconfig | 27 +++++++++++ boot/image-fit-sig.c | 15 ++++++ test/py/tests/test_vboot.py | 96 +++++++++++++++++++++++++++++++++++++ 3 files changed, 138 insertions(+) -- 2.53.0
