Re: [PATCH v3 3/3] test: fit: verify dm-verity roothash is covered by the config signature

On 2026-07-21T02:34:47, Daniel Golle <[email protected]> wrote:
> test: fit: verify dm-verity roothash is covered by the config signature
>
> A dm-verity protected filesystem image is not hashed by U-Boot; its
> integrity is delegated to the kernel, which trusts the roothash taken
> from the FIT dm-verity subnode. For that chain of trust to hold, the
> roothash (and salt) must be part of the region covered by the
> configuration signature, otherwise an attacker can replace both the
> filesystem and the roothash while keeping the signature valid.
>
> Add two independent checks of this property:
>
>  - test/py/tests/test_fit_verity_sign.py signs a configuration that
>    references a filesystem image carrying a dm-verity subnode, then
>    confirms that tampering the roothash or the salt is rejected by
>    fit_check_sign. A control that tampers a byte known to be signed
>    proves the check can fail. A matching page is added under
>    doc/develop/pytest/ so the module documentation is rendered with
>    the rest of the generated docs.
>
>  - test/boot/fit_verity.c gains a runtime unit test that builds the
>    exact node list the configuration signature is computed over,
>    turns it into hashed regions and checks both that the roothash
>    bytes fall inside a signed region and that tampering them changes
>    the hash. It needs no private key, so it also runs on real devices
>    and uses the same hash path a device would.
>
> To let the unit test build the signed-region node list, rename the
> config node-list helper to fit_config_get_signed_nodes(), make it
> non-static and declare it in image.h.
>
> Signed-off-by: Daniel Golle <[email protected]>
>
> boot/image-fit-sig.c                        |  14 +-
>  doc/develop/pytest/test_fit_verity_sign.rst |  10 ++
>  include/image.h                             |  23 ++++
>  test/boot/fit_verity.c                      | 200 +++++++++++++++++++++++++++
>  test/py/tests/test_fit_verity_sign.py       | 202 ++++++++++++++++++++++++++++
>  5 files changed, 442 insertions(+), 7 deletions(-)

Reviewed-by: Simon Glass <[email protected]>