Re: [yocto] FIT image verification not working on imx8mm

Hi Michael,

On 2/22/26 5:07 PM, Michael Opdenacker via lists.yoctoproject.org wrote:
> Hi Slava,
> 
> Thanks a lot for having a look at this issue!
> 
> On 2/22/26 2:50 PM, Vyacheslav Yurkov wrote:
>> Hi Michael,
>> I believe the message is correct:
>>
>> > Verifying Hash Integrity ... sha256+ OK
>>
>> The "+" sign means the signature verification succeeded. The "-" would 
>> mean otherwise.
>>
>> I've just tried again to boot a fit image built without 
>> UBOOT_SIGN_ENABLE and got:
>>
>> > No 'signature' subnode found for '<NULL>' hash node in 'conf-my-dtb' 
>> config node
> 
> I don't think that's the case, because if I replace my "fitImage" file 
> by an unsigned one, it is still gladly accepted by U-Boot:
> 

You need to enforce signature verification such that a missing signature 
means you cannot boot proper, as far as I remember, this is NOT the default.

See the official documentation for FIT signature: 
https://docs.u-boot.org/en/latest/usage/fit/signature.html#public-key-storage

You need a "required" property (in your SPL DTB's public key node!!!) 
set to either conf or images. I believe the best practice for security 
is conf.

I also recommend triple checking your defconfig to make sure you cannot 
boot non-FIT images (e.g. legacy format) which would allow an attacker 
to bypass the signature mechanism even if enforced for FIT images.

Cheers,
Quentin