Hi,
On 2026-10-22T18:38:39, anon87111 <[email protected]> wrote:
> test: vboot: cover required image keys
>
> Add a test for two keys marked required = "image" where the FIT carries a
> signature from only one of them. Without the binding fix the single
> signature satisfies both required keys and the image boots.
>
> The default policy refuses it, required-mode "any" accepts it, and
> required-mode "all" refuses it again.
>
> All nine in tree sign-images-*.its hint "dev", and mkimage -g does not
> redirect a hint the node already carries, so a prod hinted fixture is
> needed to get two keys marked required on the image gate.
> sign-images-sha256-rsa2048-prod.its is the in tree
> sign-images-sha256-rsa2048.its with its two key-name-hint values changed.
>
> Signed-off-by: anon87111 <[email protected]>
>
> test/py/tests/test_vboot.py | 98
> +++++++++++++++++-----
> .../vboot/sign-images-sha256-rsa2048-prod.its | 42 ++++++++++
> 2 files changed, 117 insertions(+), 23 deletions(-)
> diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py
> @@ -477,6 +478,55 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding,
> sign_options, required,
> + # Both keys are now marked required = "image" and the FIT has no prod
> + # signature. The default policy is "all", so this must be refused.
> + run_bootm(sha_algo, 'required image key', '', False)
With an empty expect_string this only checks that the image does not
boot, so it would also pass if bootm failed for some unrelated reason.
Since this is the regression test for patch 1, please can you check
for the message showing that the prod key failed, e.g. "Failed to
verify required signature 'key-prod'"? Please do the same in the final
'all' case.
> diff --git a/test/py/tests/vboot/sign-images-sha256-rsa2048-prod.its
> b/test/py/tests/vboot/sign-images-sha256-rsa2048-prod.its
> @@ -0,0 +1,42 @@
> + signature {
> + algo = "sha256,rsa2048";
> + key-name-hint = "prod";
> + };
This is a copy of sign-images-sha256-rsa2048.its with only the two
hints changed. Instead, you could build the FIT from the existing .its
and run 'fdtput -t s <fit> /images/kernel/signature key-name-hint
prod' (and the same for fdt-1) before sign_fit(), since mkimage -F
re-signs an existing FIT. The test already uses fdtput on the FIT
elsewhere, and this avoids the duplicate fixture. What do you think?
Regards,
Simon
