[v5,0/6] uboot-sign: sign the SPL FIT configuration

From: Adrian Freihofer <adrian.freihofer@siemens.com>

This is v5 of Marta's series:
https://lists.openembedded.org/g/openembedded-core/message/247413

FIT verified boot is currently receiving a lot of public attention,
e.g. CVE-2026-33243 and the talk "FIT Happens: How Secure Boot
Wasn't" at OSS EU 2026:
https://osselceu2026.sched.com/event/2RaWy/fit-happens-how-secure-boot-wasnt-ahmad-fatoum-pengutronix-ek
Signing the configuration is the minimum U-Boot itself recommends,
so I would like to get this merged rather than let it stall further.
Further hardening can be done on top.

Migration notes for users with SPL_SIGN_ENABLE = "1":
- The FIT configuration is signed by default and the public key in
  the SPL DTB becomes required = "conf" instead of "image".
- Custom images added via UBOOT_FIT_USER_SETTINGS which are referenced
  by the configuration need a hash node, otherwise mkimage cannot sign
  the configuration.
- The old behavior is available with SPL_SIGN_CONF = "0" and
  SPL_SIGN_INDIVIDUAL = "1" but triggers a warning.
A patch for yocto-docs documenting the new variables and the migration
is needed as well.

Changes in v5:
- Patch 1: unchanged.
- Patch 2:
  - Drop the hunk in KernelFitImageBase._check_signing which used the
    undefined variable req_values. This raised a NameError in all
    signed kernel FIT tests. With UBOOT_SIGN_ENABLE = "1" all kernel
    FIT configurations are signed, and unsigned kernel FIT images
    return early from _check_signing. So no check is needed.
    Fixes: https://patchwork.yoctoproject.org/project/oe-core/patch/20261008060935.4225-2-rybczynska@gmail.com/
- Patch 3: new, enhances the selftest checks of patch 2:
  - Check the image signature and the image hash nodes independently
    and verify that the nodes of the disabled mode are absent from
    the its file.
  - Use the configuration name instead of a hard-coded "conf".
  - Verify the sign-images property of the configuration signature.
  - Verify the required, algo and key-name-hint properties of the
    public key in the deployed SPL DTB.
- Patch 4: new, test for configuration signing (non-default).
- Patch 5: commit message typo fix only.
- Patch 6: new, the non-default test now covers image signing.

Adrian Freihofer (3):
  oe-selftest: fitimage: check image vs. configuration signing
  oe-selftest: fitimage: test SPL FIT configuration signing
  oe-selftest: fitimage: test SPL FIT individual image signing

Marta Rybczynska (3):
  uboot-sign: add the option to sign SPL FIT configurations
  oe-selftest: fitimage: support new schema for uboot configuration
    signing
  uboot-sign: enable signing SPL FIT configuration

 meta/classes-recipe/uboot-sign.bbclass   |  86 ++++++++++++++-
 meta/lib/oeqa/selftest/cases/fitimage.py | 130 +++++++++++++++++++----
 2 files changed, 191 insertions(+), 25 deletions(-)