diff mbox series

kernel-fit-image: Don't add hash node when signing is enabled

Message ID 20260819-bugfix-dont-add-hash-node-to-signed-fit-images-v1-1-c0ffc1a0fc17@liebherr.com
State New
Headers show
Series kernel-fit-image: Don't add hash node when signing is enabled | expand

Commit Message

Jonas Juffinger via B4 Relay Aug. 19, 2026, 8:21 a.m. UTC 
From: Jonas Juffinger <jonas.juffinger@liebherr.com>

When configuration signing is enabled, mkimage does not fill
the hash node even if it present. This causes the verification
to fail with a "Bad Data Hash' error because the hash exists
but it empty.

This patch adds a check to only add the hash node if signing
is not enabled.

The example FIT from the official documentation also shows
the configuration field with only the signature, without the
hash field:
https://docs.u-boot.org/en/latest/usage/fit/signature.html#signed-configurations

Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
---
 meta/lib/oe/fitimage.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


---
base-commit: 6f7a806ece411ab32e4b1c08a0299400bdf3b588
change-id: 20260819-bugfix-dont-add-hash-node-to-signed-fit-images-12ab0c9271ce

Best regards,
diff mbox series

Patch

diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
index d4dacdd508..142a5d60f7 100644
--- a/meta/lib/oe/fitimage.py
+++ b/meta/lib/oe/fitimage.py
@@ -485,7 +485,7 @@  class ItsNodeRootKernel(ItsNode):
             f"{default_flag} {', '.join(conf_desc)}",
             opt_props=opt_props
         )
-        if self._hash_algo:
+        if self._hash_algo and not self._sign_enable:
             ItsNodeHash(
                 "hash-1",
                 conf_node,