Re: [PATCH v8 4/8] image-fit-sig: Optionally require signatures

On 8/22/26 00:48, Jonas Karlman wrote:
> Hi Ludwig,
> 
> On 8/13/2026 8:09 AM, Ludwig Nussel via U-Boot wrote:
>> If U-Boot is built with signature verification but no keys are
>> included in the device tree, the boot would still continue.
>> Introduce FIT_SIGNATURE_REQUIRED to avoid a fail-open setup.
>> Defaults to off so existing setups are not affected; boards wanting
>> fail-closed behaviour must enable it explicitly.
>>
>> Consistently use log_err for errors in fit_config_verify_required_keys()
>> while at it
[...]
>>
>>   	/* Work out what we need to verify */
>>   	key_node = fdt_subnode_offset(key_blob, 0, FIT_SIG_NODENAME);
>>   	if (key_node < 0) {
>> -		debug("%s: No signature node found: %s\n", __func__,
>> -		      fdt_strerror(key_node));
>> +		log_err("No signature node found: %s\n", fdt_strerror(key_node));
> 
> This change is causing a verbose error messages on Rockchip where the
> FIT_SIGNATURE feature it used to check image integrity during boot. The
> config nodes is not expected to contain any signature, only hash(es) of
> images.

Is the message a problem? The intention was to at least leave some clue 
about the potential fail-open behavior.
Looks like you are also not using signed configurations with is even 
more suspicious:
https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations

cu
Ludwig

-- 
Ludwig Nussel
Siemens AG
www.siemens.com