{"id":2231241,"url":"http://patchwork.ozlabs.org/api/covers/2231241/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/cover/20260430122629.606153-1-ludwig.nussel@siemens.com/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260430122629.606153-1-ludwig.nussel@siemens.com>","list_archive_url":null,"date":"2026-04-30T12:25:59","name":"[v2,0/4] Improve FIT signature handling","submitter":{"id":90265,"url":"http://patchwork.ozlabs.org/api/people/90265/?format=json","name":"Ludwig Nussel","email":"ludwig.nussel@siemens.com"},"mbox":"http://patchwork.ozlabs.org/project/uboot/cover/20260430122629.606153-1-ludwig.nussel@siemens.com/mbox/","series":[{"id":502295,"url":"http://patchwork.ozlabs.org/api/series/502295/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=502295","date":"2026-04-30T12:25:59","name":"Improve FIT signature handling","version":2,"mbox":"http://patchwork.ozlabs.org/series/502295/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/covers/2231241/comments/","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=siemens.com header.i=ludwig.nussel@siemens.com\n header.a=rsa-sha256 header.s=fm2 header.b=NKcH4LxG;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=siemens.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n secure) header.d=siemens.com header.i=ludwig.nussel@siemens.com\n header.b=\"NKcH4LxG\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=siemens.com","phobos.denx.de;\n spf=pass smtp.mailfrom=ludwig.nussel@siemens.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5thV14fyz1yHZ\n\tfor ; Thu, 30 Apr 2026 22:26:50 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 9082B842C7;\n\tThu, 30 Apr 2026 14:26:45 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id E4DC283FDB; Thu, 30 Apr 2026 14:26:43 +0200 (CEST)","from mta-65-227.siemens.flowmailer.net\n (mta-65-227.siemens.flowmailer.net [185.136.65.227])\n (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id BC12E803C6\n for ; Thu, 30 Apr 2026 14:26:41 +0200 (CEST)","by mta-65-227.siemens.flowmailer.net with ESMTPSA id\n 2026043012263804dea308fb000207f0 for ;\n Thu, 30 Apr 2026 14:26:38 +0200"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_MED,\n DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,\n RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,\n SPF_HELO_PASS,SPF_NONE autolearn=ham autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2;\n d=siemens.com; i=ludwig.nussel@siemens.com;\n h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc;\n bh=qtY1TnBD6vjNuTTr2QgV4ZexoNISEvInbXkse0u6WNs=;\n b=NKcH4LxG2FPAP/j5bozQer+kTQzorLvw0zYe3DIOqI0EYGDVrnHYvUoS1n4Z+Tcy4GEsyv\n qgtTPsfYMBZ5u7+S3Gajc/f7vnrJ3PeVYK5fS1IL5V1BiKA6dkrAAoEDAjf45qag39XpoBEo\n 5DmsyXJBLG9vqtRMLfJa+T++0N2Dnb0ClJXRdvSfT6x38/CMyCiAkY+IBdSNRQGom5SKuwC9\n CzF32stw+rPhMsbQ9ixVReKLja95JQXhhqrbOgZIiKbcygAiDpKcM6g3ueS65KDYhrhlO4lO\n kVYwJ9oWx4GfpolrZO/rS2V0zOl1qI7vDLwNA38/mHD02Va/ioNQGw3w==;","From":"Ludwig Nussel ","To":"u-boot@lists.denx.de","Cc":"Ludwig Nussel , Anshul Dalal ,\n George Chan ,\n Heinrich Schuchardt ,\n James Hilliard ,\n Jonas Karlman ,\n \"Kory Maincent (TI.com)\" ,\n Kunihiko Hayashi ,\n Marek Vasut ,\n Martin Schwan ,\n Mattijs Korpershoek ,\n Mayuresh Chitale ,\n Neil Armstrong ,\n Osama Abdelkader ,\n Patrice Chotard , Peng Fan ,\n Quentin Schulz ,\n Sam Protsenko ,\n Shiji Yang , Simon Glass ,\n Tom Rini , Tuomas Tynkkynen ,\n Wolfgang Wallner , Yao Zi ","Subject":"[PATCH v2 0/4] Improve FIT signature handling","Date":"Thu, 30 Apr 2026 14:25:59 +0200","Message-ID":"<20260430122629.606153-1-ludwig.nussel@siemens.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-Flowmailer-Platform":"Siemens","Feedback-ID":"519:519-1328817:519-21489:flowmailer","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"This patch series tries to improve dealing with FIT\n(configuration-)signatures a bit:\n - make signatures work with QEMU. QEMU brings it's own device tree at\n a memory address. U-Boot expects public keys in it's own DT though.\n So merge both.\n - (optionally) enforce signatures so we can't accidentally boot\n unsigned fit images. Quite an easy oversight, esp when qemu\n previously didn't even use the built in DT.\n - make iminfo verify configuration signatures, not just image hashes\n\nChanges in v2:\n - introduce FIT_SIGNATURE_REQUIRED\n - document fit_all_configurations_verify()\n\nLudwig Nussel (4):\n qemu: overlay signature nodes\n mkimage: define log_err and log_info\n image-fit-sig: Optionally require signatures\n iminfo: also verify signatures\n\n board/emulation/qemu-arm/qemu-arm.c | 33 +++++++++++++++++++-\n boot/Kconfig | 10 ++++++\n boot/image-fit-sig.c | 12 +++++---\n boot/image-fit.c | 48 +++++++++++++++++++++++++++++\n boot/image-pre-load.c | 3 --\n cmd/bootm.c | 7 +++++\n include/image.h | 1 +\n tools/mkimage.h | 2 ++\n 8 files changed, 107 insertions(+), 9 deletions(-)"}