diff mbox series

[v6,07/11] doc: signature.txt: Document the keydir and keyfile arguments

Message ID 20210219184520.616270-8-mr.nuke.me@gmail.com
State Accepted
Commit fb6532ec6c0c247dc204f65cb298d0865f7eaf3b
Delegated to: Tom Rini
Headers show
Series Add support for ECDSA image signing | expand

Commit Message

Alex G. Feb. 19, 2021, 6:45 p.m. UTC 
After lots of debating, this documents how we'd like mkimage to treat
'keydir' and 'keyfile' arguments. The rest is in the docs.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 doc/uImage.FIT/signature.txt | 13 +++++++++++++
 1 file changed, 13 insertions(+)

Comments

Tom Rini April 16, 2021, 12:25 p.m. UTC | #1 
On Fri, Feb 19, 2021 at 12:45:16PM -0600, Alexandru Gagniuc wrote:

> After lots of debating, this documents how we'd like mkimage to treat
> 'keydir' and 'keyfile' arguments. The rest is in the docs.
> 
> Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
> Reviewed-by: Simon Glass <sjg@chromium.org>

Applied to u-boot/master, thanks!
diff mbox series

Patch

diff --git a/doc/uImage.FIT/signature.txt b/doc/uImage.FIT/signature.txt
index 0139295d33..d9a9121190 100644
--- a/doc/uImage.FIT/signature.txt
+++ b/doc/uImage.FIT/signature.txt
@@ -472,6 +472,19 @@  Test Verified Boot Run: signed config with bad hash: OK
 Test passed
 
 
+Software signing: keydir vs keyfile
+-----------------------------------
+
+In the simplest case, signing is done by giving mkimage the 'keyfile'. This is
+the path to a file containing the signing key.
+
+The alternative is to pass the 'keydir' argument. In this case the filename of
+the key is derived from the 'keydir' and the "key-name-hint" property in the
+FIT. In this case the "key-name-hint" property is mandatory, and the key must
+exist in "<keydir>/<key-name-hint>.<ext>" Here the extension "ext" is
+specific to the signing algorithm.
+
+
 Hardware Signing with PKCS#11 or with HSM
 -----------------------------------------