Thanks Ludwig - I hadn't referenced your series in my cover letter, and I should have.
v8 4/8 does close the configuration side: fit_config_verify_required_keys() gains FIT_REQUIRE_CONFIG_SIGS and fails closed when no keys with required='conf' are present. The case I reported is the other gate. fit_image_verify_required_sigs() looks up the /signature node in the control DTB and, when it is missing, sets *no_sigsp = 1 and returns 0 with only a debug() message. Every caller then treats the image as not requiring signatures, so nothing downstream can fail. As far as I can see from your v8 hunks that path is unchanged. Two things follow: - I picked FIT_REQUIRE_CONFIG_SIGS for my Kconfig symbol, which collides with yours. I'll rename mine to FIT_REQUIRE_IMAGE_SIGS (plus the SPL variant), default off, since the two gates have different blast radius. - Jonas raised on 4/8 that Rockchip uses FIT_SIGNATURE for image integrity only, not signed configurations. An image-side required-signature gate hits that setup directly, which is the other reason to keep it a separate symbol that is off by default. I'll rebase on top of your series and resend once v8 lands, rather than adding a patch to a series that already carries review tags. Tom, shout if you'd rather see it folded in instead. Eva On Tue, Sep 15, 2026 at 8:23 PM Ludwig Nussel <[email protected]> wrote: > > On 9/14/26 19:34, Tom Rini wrote: > > On Tue, Sep 08, 2026 at 09:27:03AM +1200, Eva Crystal wrote: > >> > >> Reporting a fail-open condition in FIT signature enforcement. > > [...] > > Hello. Yes, please follow > > https://docs.u-boot-project.org/en/latest/develop/sending_patches.html > > and provide a fix and test for this issue, thanks! > > https://patchwork.ozlabs.org/project/uboot/patch/20260813080943.v8.4.6d1d5d14140677a76a7cd7bb99a9088d8c8f480c@changeid/ > > cu > Ludwig > > -- > Ludwig Nussel > Siemens AG > www.siemens.com >
