Document RSA and ECDSA private key filename preferences and fallback behavior in the FIT guide and mkimage manual.
Signed-off-by: Ayoub Zaki <[email protected]> --- Changes in v2: - Allow name.pem in the existing mkimage manual requirement. - Clarify that either file must contain a PEM-encoded private key. doc/mkimage.1 | 5 +++++ doc/usage/fit/signature.rst | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/doc/mkimage.1 b/doc/mkimage.1 index 9a2d07cee75..84b2338a7bd 100644 --- a/doc/mkimage.1 +++ b/doc/mkimage.1 @@ -385,6 +385,8 @@ Append a ramdisk or initramfs file to the image. Specifies the directory containing keys to use for signing. This directory should contain a private key file .IR name .key +or +.IR name .pem for use with signing, and a certificate .IR name .crt (containing the public key) for use with verification. The public key is only @@ -392,6 +394,9 @@ necessary when embedding it into another device tree using .BR \-K . .I name is the value of the signature node's \(oqkey-name-hint\(cq property. +RSA prefers the .key extension and ECDSA prefers .pem. If the preferred +private key file does not exist, mkimage tries the other extension. +Either file must contain a PEM-encoded private key. . .TP .BI \-G " key-file" diff --git a/doc/usage/fit/signature.rst b/doc/usage/fit/signature.rst index da08cc75c3a..8cd84322ebe 100644 --- a/doc/usage/fit/signature.rst +++ b/doc/usage/fit/signature.rst @@ -497,9 +497,10 @@ the path to a file containing the signing key. The alternative is to pass the 'keydir' argument. In this case the filename of the key is derived from the 'keydir' and the "key-name-hint" property in the -FIT. In this case the "key-name-hint" property is mandatory, and the key must -exist in "<keydir>/<key-name-hint>.<ext>" Here the extension "ext" is -specific to the signing algorithm. +FIT. The "key-name-hint" property is mandatory. mkimage first tries +``<keydir>/<key-name-hint>.key`` for RSA or +``<keydir>/<key-name-hint>.pem`` for ECDSA. If that file does not exist, +it tries the other extension. Either file must contain a PEM-encoded private key. Hardware Signing with PKCS#11 or with HSM -- 2.53.0
