Hi Ayoub, On 2026-10-28T10:31:01+11:00, Ayoub Zaki <[email protected]> wrote: > doc: fit: Document private key filename fallbacks > > Document RSA and ECDSA private key filename preferences and fallback > behavior in the FIT guide and mkimage manual. > > Signed-off-by: Ayoub Zaki <[email protected]> > > doc/mkimage.1 | 5 +++++ > doc/usage/fit/signature.rst | 7 ++++--- > 2 files changed, 9 insertions(+), 3 deletions(-)
> diff --git a/doc/usage/fit/signature.rst b/doc/usage/fit/signature.rst > @@ -499,9 +499,10 @@ the path to a file containing the signing key. > +FIT. The "key-name-hint" property is mandatory. mkimage first tries > +``<keydir>/<key-name-hint>.key`` for RSA or > +``<keydir>/<key-name-hint>.pem`` for ECDSA. If that file does not exist, > +it tries the other extension. Either file must contain a PEM-encoded private > key. Your cover letter explains what happens when lookup fails, but the docs don't. If neither file exists, mkimage skips that signature node and still succeeds (fit_image_process_sig() treats -ENOENT as success), while after patch 1 any other open error such as EACCES makes it fail. People are often surprised to find an image unsigned, so please can you add a sentence on this here, and perhaps in mkimage.1 too. The last line goes past 80 columns, so please rewrap the paragraph to match the rest of the file. Regards, Simon
