Hi Ayoub, On 2026-10-28T10:31:01+11:00, Ayoub Zaki <[email protected]> wrote:
> Allow mkimage -k to use either .key or .pem for PEM-encoded private keys. > Preserve the existing filename preference for backward compatibility. > Try the alternate extension only when the preferred key file is missing. The fallback logic is now written twice, in the ECDSA read_key() and in rsa_pem_get_priv_key(), with different shapes and messages. The only real difference is which extension comes first. The rule (try the preferred file, then the other one only on ENOENT) is the same for both, so should be in a helper shared by RSA and ECDSA, with the preferred extension passed in. Both are already linked into the tools alongside lib/fdt-libcrypto.c so there is a natural place for it. > Binman's FIT signing-key lookup still requires <key-name-hint>.key. > Support for .pem files in that lookup needs a separate contribution. Just to check, is there a reason to keep this separate? With patch 3 binman can sign ECDSA images from a .key file, which is nice, but the .pem change looks small: _get_keys_dir() in tools/binman/etype/fit.py just needs to accept either extension. It would be worth adding it to this series (with a binman test) so that mkimage and binman agree on which key files are accepted. What do you think? Regards, Simon
