On 10/1/26 18:14, Simon Glass wrote:
On 2026-09-25T07:27:39, Eva Crystal <[email protected]> wrote:
Ludwig Nussel's "Improve FIT signature handling" closes the same fail-open
condition on the configuration gate with FIT_REQUIRE_CONFIG_SIGS. It does
not touch the image gate, which has its own early return in a different
function. This series adds the matching option for that gate,
FIT_REQUIRE_IMAGE_SIGS, along with SPL_FIT_REQUIRE_IMAGE_SIGS, both
defaulting to n
This leaves two options (four, counting SPL) for what a board
maintainer sees as one decision: 'this board requires signed FITs'. I
cannot think of a sensible setup where one gate fails closed while the
other stays open, so a board that enables only one is probably wrong
without knowing it. Please can you work with Ludwig so that a single
option controls both gates, perhaps his FIT_REQUIRE_CONFIG_SIGS
renamed to something broader? The easiest way may be for this patch to
go into his series. What do you think?
IIUC the config signature verification logic includes the image hashes
and does run the image verification logic to check the hashes as well.
So if we enforce config signatures, enforcing image signatures as well
would be redundant and surprising.
So the code would have to enforce config signatures and disable checking
image signatures when loading images via the config path. At the same
time it has to enforce image signatures when loading images directly,
without going through the config loading. (Or don't allow direct image
loading when enforcing config signatures).
At this point I cannot put the effort to implement that extra logic
though. I can remove the config sig enforcement stuff from my series if
someone want's to do it though.
Not sure it makes sense to invest too much here anyway.
Time would be better spent on
https://github.com/open-source-firmware/flat-image-tree/pull/44 to pave
the way for whole-fit signing in a simpler way IMO.
cu
Ludwig
--
Ludwig Nussel
Siemens AG
www.siemens.com
