On 8/22/26 00:48, Jonas Karlman wrote:
Hi Ludwig,
On 8/13/2026 8:09 AM, Ludwig Nussel via U-Boot wrote:
If U-Boot is built with signature verification but no keys are
included in the device tree, the boot would still continue.
Introduce FIT_SIGNATURE_REQUIRED to avoid a fail-open setup.
Defaults to off so existing setups are not affected; boards wanting
fail-closed behaviour must enable it explicitly.
Consistently use log_err for errors in fit_config_verify_required_keys()
while at it
[...]
/* Work out what we need to verify */
key_node = fdt_subnode_offset(key_blob, 0, FIT_SIG_NODENAME);
if (key_node < 0) {
- debug("%s: No signature node found: %s\n", __func__,
- fdt_strerror(key_node));
+ log_err("No signature node found: %s\n",
fdt_strerror(key_node));
This change is causing a verbose error messages on Rockchip where the
FIT_SIGNATURE feature it used to check image integrity during boot. The
config nodes is not expected to contain any signature, only hash(es) of
images.
Is the message a problem? The intention was to at least leave some clue
about the potential fail-open behavior.
Looks like you are also not using signed configurations with is even
more suspicious:
https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations
cu
Ludwig
--
Ludwig Nussel
Siemens AG
www.siemens.com
