On Tue, Oct 13, 2026 at 2:29 AM Ludwig Nussel wrote: > At this point I cannot put the effort to implement that extra logic > though. I can remove the config sig enforcement stuff from my series if > someone want's to do it though.
Thanks Ludwig, that makes sense. I can't take on the combined config/image logic either, so please keep FIT_REQUIRE_CONFIG_SIGS in your series as it is, since it already closes the common path. I'm withdrawing my image-gate series. The image-signature fail-open stays documented in this thread for whoever picks it up later, possibly together with the whole-FIT signing work. Eva Crystal (0xiviel) XSource Security https://xsourcesec.com
