On 9/15/26 17:41, Tom Rini wrote:
On Tue, Sep 15, 2026 at 08:45:23PM +1200, Eva Crystal wrote:
Thanks Ludwig - I hadn't referenced your series in my cover letter,
and I should have.
v8 4/8 does close the configuration side: fit_config_verify_required_keys()
gains FIT_REQUIRE_CONFIG_SIGS and fails closed when no keys with
required='conf' are present.
The case I reported is the other gate. fit_image_verify_required_sigs()
looks up the /signature node in the control DTB and, when it is missing,
sets *no_sigsp = 1 and returns 0 with only a debug() message. Every caller
then treats the image as not requiring signatures, so nothing downstream
can fail. As far as I can see from your v8 hunks that path is unchanged.
Two things follow:
- I picked FIT_REQUIRE_CONFIG_SIGS for my Kconfig symbol, which collides
with yours. I'll rename mine to FIT_REQUIRE_IMAGE_SIGS (plus the SPL
variant), default off, since the two gates have different blast radius.
- Jonas raised on 4/8 that Rockchip uses FIT_SIGNATURE for image integrity
only, not signed configurations. An image-side required-signature gate
hits that setup directly, which is the other reason to keep it a separate
symbol that is off by default.
I'll rebase on top of your series and resend once v8 lands, rather than
adding a patch to a series that already carries review tags.
Tom, shout if you'd rather see it folded in instead.
Since Ludwig is already working in this area, I'd like his thoughts on
the issue / solution, and if it would make more sense to fold this in to
his series or not. Thanks.
I didn't touch the image path at all indeed. So perfect if Eva takes
care of that. My series already contains too many things and had too
many iterations. I fear that expanding the scope would delay acceptance
further.
cu
Ludwig
--
Ludwig Nussel
Siemens AG
www.siemens.com
