Re: [v3,0/3] boot: fit: authenticate the dm-verity roothash

Hi Daniel,

On 2026-07-21T02:34:47, Daniel Golle <[email protected]> wrote:

> v3: address comments by Simon Glass

Thanks for the rework - the doc additions in signature.rst and
dm-verity.rst read well, and the test fix is a good catch.

I still think we should state the compatibility break explicitly
somehow: because U-Boot rebuilds the node list rather than trusting
hashed-nodes, an image signed by an older mkimage that carries a
dm-verity subnode stops verifying under this fix, and an image signed
by the new mkimage does not verify on an older U-Boot.

The new language in dm-verity.rst documents the security property (the
roothash can no longer be swapped out), but it doesn't warn that
deployed images must be re-signed after upgrading and that mixed
old/new fleets need care.

The break is unavoidable I think and I may be overthinking all this,
but it would be nice to avoid people getting confused.

Regards,
Simon