Re: [PATCH v2] tools: fit: sign all config image references

On 2026-07-28T16:18:39, James Hilliard <[email protected]> wrote:
> tools: fit: sign all config image references
>
> Target-side configuration verification builds the signed-region list from
> every image-reference property in the selected configuration. Host-side
> signing still uses either the signature node sign-images property or the
> legacy kernel/fdt/script default list.
>
> This lets mkimage generate configuration signatures which U-Boot cannot
> verify when the configuration references other image types, such as
> firmware, loadables or ramdisk entries. It also lets the host and target
> disagree when sign-images names only a subset of the configuration images.
>
> Build the host-side signing list from the configuration properties in the
> same way as target-side verification. Use one shared property classifier so
> the host and target cannot drift apart again. This makes signed
> configurations cover the root node, the configuration node, every
> referenced image node, and its hash/cipher subnodes, regardless of image
> type.
>
> Warn when a legacy sign-images property is present, since it no longer
> limits the signed image list. Require every referenced image to have at
> least one hash subnode. Add sandbox coverage proving that a firmware
> reference omitted from sign-images is still recorded in hashed-nodes and
> verified.
>
> Update the signed-configuration documentation to describe the same rule and
> the hash-subnode requirement.
>
> Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list")
> Signed-off-by: James Hilliard <[email protected]>
>
> boot/image-fit-sig.c                               |  9 +--
>  boot/image-fit.c                                   | 17 +++++
>  doc/board/ti/k3.rst                                | 10 ++-
>  doc/usage/fit/beaglebone_vboot.rst                 |  5 +-
>  doc/usage/fit/sign-configs.rst                     | 13 +++-
>  doc/usage/fit/signature.rst                        | 26 +++----
>  doc/usage/fit/uefi.rst                             |  2 -
>  include/image.h                                    |  9 +++
>  test/py/tests/test_vboot.py                        | 11 ++-
>  test/py/tests/vboot/sign-configs-algo-arg.its      |  1 -
>  test/py/tests/vboot/sign-configs-sha1-pss.its      |  1 -
>  test/py/tests/vboot/sign-configs-sha1.its          | 11 +++
>  .../tests/vboot/sign-configs-sha256-pss-prod.its   |  1 -
>  test/py/tests/vboot/sign-configs-sha256-pss.its    |  1 -
>  test/py/tests/vboot/sign-configs-sha256.its        |  1 -
>  test/py/tests/vboot/sign-configs-sha384.its        |  1 -
>  tools/fit_image.c                                  | 12 ++--
>  tools/image-host.c                                 | 84 +++++++++-------------
>  18 files changed, 121 insertions(+), 94 deletions(-)

Reviewed-by: Simon Glass <[email protected]>