fit_image_verify_required_sigs() returns success when the U-Boot control devicetree has no "/signature" node, so a FIT whose image signatures are absent, malformed or invalid verifies anyway and the only indication is a debug() call which a normal build compiles out. I reported this on the list on 2026-09-07 as "[SECURITY] FIT signature enforcement fails open when the control DTB has no /signature node".
Ludwig Nussel's "Improve FIT signature handling" closes the same fail-open condition on the configuration gate with FIT_REQUIRE_CONFIG_SIGS. It does not touch the image gate, which has its own early return in a different function. This series adds the matching option for that gate, FIT_REQUIRE_IMAGE_SIGS, along with SPL_FIT_REQUIRE_IMAGE_SIGS, both defaulting to n, and a test/py case covering the missing-node path. 1/2 also raises the missing-node report from debug() to log_warning(), once per boot. Ludwig's configuration gate deliberately keeps debug() after Jonas Karlman pointed out that Rockchip enables FIT_SIGNATURE for image hash integrity alone and has no "/signature" node by design. The commit message of 1/2 explains why this gate diverges. Jonas is on Cc. Based on next at 9e002445cd0d with Ludwig's v10 applied on top, following Tom's request on the v9 thread on 2026-09-16, "Please make sure v10 is based on the current next branch". v10 is at https://lore.kernel.org/u-boot/[email protected]/ and its seven patches are listed as prerequisite-patch-id below. Note that the series does not apply to main: v10 4/7 depends on f252d228be ("tools: fit: sign all config image references"), which is on next only. checkpatch warns on a 119-character line in patch 1; it is a verbatim console transcript and re-wrapping it would misrepresent what the binary printed. Eva Crystal (2): image-fit-sig: fail when the control FDT has no /signature node test: vboot: add coverage for a control FDT with no /signature node boot/Kconfig | 34 +++++++++++ boot/image-fit-sig.c | 15 ++++- test/py/tests/test_vboot.py | 109 ++++++++++++++++++++++++++++++++++++ tools/mkimage.h | 1 + 4 files changed, 157 insertions(+), 2 deletions(-) base-commit: 9e002445cd0d47d3965312f12e97a18e1ed8bd53 prerequisite-patch-id: 538dac9ee272034842d8a60d8df4f8b070018d33 prerequisite-patch-id: 5fa9f72555e76e6c88a57610b4c1d802408e1989 prerequisite-patch-id: e8d9d6c807dd9998e7f666dd283838e58ae54a7f prerequisite-patch-id: 99c40b0d120a323d736144ed1e918d61076d3ddd prerequisite-patch-id: 6089c7c67ff501e18182647ca27e5a111bbd5247 prerequisite-patch-id: c30e2a1afe9372416f5af90a2e6eff1a181e06af prerequisite-patch-id: 1cdb386dab84419340acfea28362cb56e9a60cd4 -- 2.53.0
