diff options
| author | Alexander Dahl <ada@thorsis.com> | 2024-06-20 16:20:59 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2024-07-05 13:57:01 -0600 |
| commit | 6074f6e85783f582e8524778fff170ff05b35a91 (patch) | |
| tree | a7962882020348dfc83d42d122d119907c14c507 /tools | |
| parent | d36394cff8cee764aea75860ceac4655f7f3e944 (diff) | |
| download | u-boot-6074f6e85783f582e8524778fff170ff05b35a91.zip u-boot-6074f6e85783f582e8524778fff170ff05b35a91.tar.gz u-boot-6074f6e85783f582e8524778fff170ff05b35a91.tar.bz2 | |
mkimage: Allow 'auto-conf' signing of scripts
U-Boot configured for verified boot with the "required" option set to
"conf" also checks scripts put in FIT images for a valid signature, and
refuses to source and run such a script if the signature for the
configuration is bad or missing. Such a script could not be packaged
before, because mkimage failed like this:
% tools/mkimage -T script -C none -d tmp/my.scr -f auto-conf -k tmp -g dev -o sha256,rsa4096 my.uimg
Failed to find any images for configuration 'conf-1/signature'
tools/mkimage Can't add hashes to FIT blob: -1
Error: Bad parameters for FIT image type
This is especially unfortunate if LEGACY_IMAGE_FORMAT is disabled as
recommended.
Listing the script configuration in a "sign-images" subnode instead,
would have added even more complexity to the already complex auto fit
generation code.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/image-host.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/image-host.c b/tools/image-host.c index 7bfc0cb..49ce743 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -730,7 +730,7 @@ static const char *fit_config_get_image_list(const void *fit, int noffset, int *lenp, int *allow_missingp) { static const char default_list[] = FIT_KERNEL_PROP "\0" - FIT_FDT_PROP; + FIT_FDT_PROP "\0" FIT_SCRIPT_PROP; const char *prop; /* If there is an "sign-image" property, use that */ |