A key marked required = "image" in the control FDT is never bound to its
own verification. fit_image_verify_required_sigs() passes each required
key's node offset to fit_image_verify_sig(), which ignores it and calls
fit_image_check_sig() with required_keynode set to -1, documented in tree
as "any signature will do". Every required key iteration is then satisfied
by any signature verifying under any key in the FDT, so two keys marked
required = "image" collapse to one.
Patch 1 binds the key. Patch 2 adds required-mode on the image gate so the
two gates behave the same way, defaulting to "all". Patch 3 adds the
fixture and the regression test.
Changes in v3:
- add required-mode support on the image gate, default "all" (Simon Glass)
- add a regression test plus the prod hinted image fixture (Simon Glass)
- rebase from next onto main, which carries the ecdsa test rework
Changes in v2:
- add a Fixes tag (Yao Zi)
- move coordination context below the line and trim the commit message
(Yao Zi)
---
On the anonymity question from the v2 review: pseudonymous rather than
anonymous. anon87111 is a stable identity and reachable at this address.
Verification, against main at 32eb8bb43b:
38 passed, 0 failed in the vboot suite.
sha256-required-image passes with patch 1 applied.
With patch 1 reverted and patches 2 and 3 kept, it fails on the
run_bootm(boots=False) oracle, so the test does catch the defect:
AssertionError: assert 'sandbox: continuing, as we cannot run' not in
sha256-pss-required and sha256-pss-pad-required still pass, so the
configuration gate is unchanged by patch 2.
Why patch 3 adds a fixture rather than reusing the existing ones. All nine
in tree sign-images-*.its hint "dev", and
sign-configs-sha256-rsa2048-pss-prod.its is the only prod hinted file in
the tree. mkimage -g cannot redirect a hint the node already carries:
tools/image-host.c reads FIT_KEY_HINT from the node at four sites and the
-g fallback fires only when the node has no hint. So two keys both marked
required = "image" cannot be produced from the existing fixtures by any
flag.
Based on main rather than next. next is an ancestor of main and 316
commits behind it, so it is not the development tip.
Separate from "[PATCH 0/2] image-fit-sig: close the image-signature
fail-open gate", which is a control FDT with no /signature node at all.
Neither fix covers the other. Also separate from "[PATCH v10 0/7] Improve
FIT signature handling" [1], which is the configuration gate and is not
landed anywhere as of today.
[1]
https://lore.kernel.org/u-boot/[email protected]/
anon87111 (3):
image-fit-sig: bind a required image key to its own verification
image-fit-sig: honour required-mode on the image gate
test: vboot: cover required image keys
boot/image-fit-sig.c | 35 ++++++-
doc/usage/fit/signature.rst | 13 +--
test/py/tests/test_vboot.py | 98 ++++++++++++++-----
.../vboot/sign-images-sha256-rsa2048-prod.its | 42 ++++++++
4 files changed, 154 insertions(+), 34 deletions(-)
create mode 100644 test/py/tests/vboot/sign-images-sha256-rsa2048-prod.its
--
2.53.0
