[OE-core] [PATCH v1] u-boot-sign.bbclass: support to verify signed FIT image

[Jamin Lin via lists.openembedded.org]

It does not verify the signed FIT image of kernel and uboot.
To catch the unexpected errors as far as possible at the build time,
add uboot-fit-check-sign tool which is provided by u-boot tools to
verify the signed FIT image.

Signed-off-by: Jamin Lin <jamin_...@aspeedtech.com>
---
 meta/classes-recipe/uboot-config.bbclass |  3 +++
 meta/classes-recipe/uboot-sign.bbclass   | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/meta/classes-recipe/uboot-config.bbclass 
b/meta/classes-recipe/uboot-config.bbclass
index 9be1d64d3e..0c579e8861 100644
--- a/meta/classes-recipe/uboot-config.bbclass
+++ b/meta/classes-recipe/uboot-config.bbclass
@@ -94,6 +94,9 @@ SPL_MKIMAGE_SIGN_ARGS ?= ""
 UBOOT_DTB ?= ""
 UBOOT_DTB_BINARY ??= ""
 
+# uboot-fit_check_sign command
+UBOOT_FIT_CHECK_SIGN ?= "uboot-fit_check_sign"
+
 python () {
     ubootmachine = d.getVar("UBOOT_MACHINE")
     ubootconfigflags = d.getVarFlags('UBOOT_CONFIG')
diff --git a/meta/classes-recipe/uboot-sign.bbclass 
b/meta/classes-recipe/uboot-sign.bbclass
index ad04c82378..741d2216b9 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -109,6 +109,10 @@ concat_dtb() {
                        -K "${UBOOT_DTB_BINARY}" \
                        -r ${B}/fitImage-linux \
                        ${UBOOT_MKIMAGE_SIGN_ARGS}
+               # Verify the kernel image and u-boot dtb
+               ${UBOOT_FIT_CHECK_SIGN} \
+                       -k "${UBOOT_DTB_BINARY}" \
+                       -f ${B}/fitImage-linux
                cp ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SIGNED}
        fi
 
@@ -313,6 +317,12 @@ EOF
                        -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
                        -r ${UBOOT_FITIMAGE_BINARY} \
                        ${SPL_MKIMAGE_SIGN_ARGS}
+               #
+               # Verify the U-boot FIT image and SPL dtb
+               #
+               ${UBOOT_FIT_CHECK_SIGN} \
+                       -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                       -f ${UBOOT_FITIMAGE_BINARY}
        fi
 
        cp ${SPL_DIR}/${SPL_DTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED}
-- 
2.25.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#193635): 
https://lists.openembedded.org/g/openembedded-core/message/193635
Mute This Topic: https://lists.openembedded.org/mt/103734382/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-