Hi,
On 2026-10-15T03:56:30, anon87111 <[email protected]> wrote:
> image-fit-sig: bind a required image key to its own verification
>
> fit_image_verify_required_sigs() passes each required key's node offset to
> fit_image_verify_sig() as key_offset. That function never uses it: it calls
> fit_image_check_sig() with required_keynode hardcoded to -1, which both
> boot/image-fit-sig.c and include/image.h document as "any signature will
> do". rsa_verify() then tries the key named by the FIT's own key-name-hint
> and falls through to "try each of the keys in turn", so every required-key
> iteration is satisfied by any signature that verifies under any key in the
> control FDT.
>
> With two or more keys marked required = "image", one signature from any one
> of them satisfies the whole policy and the others contribute nothing.
> doc/usage/fit/signature.rst says of "required": "this indicates that the
> key must be verified for the image / configuration to be considered valid."
>
> The configuration path is correct: fit_config_verify_key() passes
> key_offset through to fit_config_check_sig().
>
> On sandbox, with key-dev and key-prod both required = "image" and a FIT
> carrying only a dev signature:
>
> Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK
> sandbox: continuing, as we cannot run Linux
>
> The doubled "dev+" is one signature satisfying both iterations, including
> the one for key-prod. The same case against the configuration gate refuses:
>
> Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev- error!
> Failed to verify required signature 'key-prod'
>
> Nothing exercises this path: there is no required = "image" anywhere in the
> tree, and test_required_key() builds only sign-configs-* fixtures.
>
> Fixes: 56518e71041f ("image: Support signing of images")
> Signed-off-by: anon87111 <[email protected]>
Are you wanting to be anonymous?
>
> boot/image-fit-sig.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
> diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
> @@ -159,7 +159,8 @@ static int fit_image_verify_sig(const void *fit, int
> image_noffset,
> if (!strncmp(name, FIT_SIG_NODENAME,
> strlen(FIT_SIG_NODENAME))) {
> ret = fit_image_check_sig(fit, noffset, data, size,
> - key_blob, -1, &err_msg);
> + key_blob, key_offset,
> + &err_msg);
Nice catch. Two things worth doing as part of this series:
1. fit_image_verify_required_sigs() has no 'required-mode' handling,
unlike fit_config_verify_required_keys(). After this fix the image
path is strictly 'all', with no way to express 'any'. It would be
worth mirroring the config path so the two gates behave consistently.
2. A regression test using the existing sign-images-*.its fixtures,
parallel to test_required_key() in test/py/tests/test_vboot.py, would
stop this rotting again. Given the fault was invisible for years
precisely because nothing exercised the path, I'd lean towards
including it here.
What do you think?
Regards,
Simon
