Hi anon87111, On 2026-10-22T18:38:39, anon87111 <[email protected]> wrote:
> Patch 1 binds the key. Patch 2 adds required-mode on the image gate so the > two gates behave the same way, defaulting to "all". Patch 1 changes behaviour for any board with more than one key marked required = 'image'. Today those boards boot with a signature from just one of the keys, and after this series they will not. That is the right fix, but please can you say so in the cover letter and in signature.rst, and tell people to use required-mode 'any' if they want to keep the old behaviour. That also gives patch 2 a clear reason to be in the series. We should consider people migrating existing infrastructure and give specific instructions there. > Patch 3 adds the fixture and the regression test. Patch 1 has a Fixes tag, so it may be picked up on its own. Its regression test, though, is in the same commit as the required-mode checks, which depend on patch 2. Please can you split it so the 'all' case (two required keys, one signature, refused) goes in with patch 1 or straight after it, and the 'any'/'all' toggling goes with patch 2? Then each fix carries its own test and the series can be bisected cleanly. Regards, Simon
