mbox series

[0/1] uboot-sign: Break dependency loop in fitImage signing

Message ID 20240118151030.1781313-1-david.wretman@ferroamp.se
Headers show
Series uboot-sign: Break dependency loop in fitImage signing | expand

Message

David Wretman Jan. 18, 2024, 3:10 p.m. UTC 
When trying to sign a Linux fitImage including a U-Boot boot script we
end up in a dependency loop.

In this scenario adding the public key used to sign the fitImage to the
U-Boot dtb depends on the availability of the Linux fitImage. The
fitImage in turn can not be created before the boot script is made
available by the U-Boot do_populate_sysroot task which can not run
before the signing of U-Boot.

To fix this, we create a dummy fitImage to feed to mkimage when adding
the public keys instead of using the Linux fitImage. The dependency on
Linux fitImage availability from U-Boot recipes can thus be removed.

This approach was earlier suggested by Sean Anderson in commit
d6858c9f45d25cfec6defec17f62139593ae87f3.

David Wretman (1):
  uboot-sign.bbclass: Break dependency loop in fitImage signing

 meta/classes-recipe/uboot-sign.bbclass | 77 ++++++++++++++++++++------
 1 file changed, 61 insertions(+), 16 deletions(-)