Hi Eva,
On 2026-09-25T07:27:39, Eva Crystal <[email protected]> wrote:
> Ludwig Nussel's "Improve FIT signature handling" closes the same fail-open
> condition on the configuration gate with FIT_REQUIRE_CONFIG_SIGS. It does
> not touch the image gate, which has its own early return in a different
> function. This series adds the matching option for that gate,
> FIT_REQUIRE_IMAGE_SIGS, along with SPL_FIT_REQUIRE_IMAGE_SIGS, both
> defaulting to n
This leaves two options (four, counting SPL) for what a board
maintainer sees as one decision: 'this board requires signed FITs'. I
cannot think of a sensible setup where one gate fails closed while the
other stays open, so a board that enables only one is probably wrong
without knowing it. Please can you work with Ludwig so that a single
option controls both gates, perhaps his FIT_REQUIRE_CONFIG_SIGS
renamed to something broader? The easiest way may be for this patch to
go into his series. What do you think?
There is also no documentation update. doc/usage/fit/signature.rst
describes required keys and how the control FDT is used, so it should
explain what happens when there is no /signature node and how to make
that fail closed.
> Note that
> the series does not apply to main: v10 4/7 depends on f252d228be ("tools:
> fit: sign all config image references"), which is on next only.
Just to check: both patches apply cleanly to next at 9e002445cd0d
without Ludwig's v10, and FWICT nothing in them depends on his code.
If the dependency is only conceptual, please say so in the cover
letter, so maintainers know the order in which the two series land
does not matter.
Regards,
Simon
