diff mbox series

kernel-fit-image: Skip sign key check for PKCS #11 URI

Message ID 20260819-bugfix-run_mkimage_sign_pkcs11_support-v1-1-363fbbf2ff66@liebherr.com
State New
Headers show
Series kernel-fit-image: Skip sign key check for PKCS #11 URI | expand

Commit Message

Jonas Juffinger via B4 Relay Aug. 19, 2026, 8:26 a.m. UTC 
From: Jonas Juffinger <jonas.juffinger@liebherr.com>

The run_mkimage_sign function checks if the required keys exist
in the keydir because mkimage does not return with an error if
the keys do not exist. This check fails if the keydir is a PKCS
 #11 URI.

This patch skips the check if the keydir is a PKCS #11 URI by
checking if it starts with "pkcs11:".

Signed-off-by: Jonas Juffinger <jonas.juffinger@liebherr.com>
---
 meta/lib/oe/fitimage.py | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)


---
base-commit: 6f7a806ece411ab32e4b1c08a0299400bdf3b588
change-id: 20260819-bugfix-run_mkimage_sign_pkcs11_support-3f7bfec9ef80

Best regards,
diff mbox series

Patch

diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py
index d4dacdd508..195edbb8e3 100644
--- a/meta/lib/oe/fitimage.py
+++ b/meta/lib/oe/fitimage.py
@@ -601,12 +601,14 @@  class ItsNodeRootKernel(ItsNode):
             bb.debug(1, "FIT image signing is disabled. Skipping signing.")
             return
 
-        # Some sanity checks because mkimage exits with 0 also without needed keys
-        sign_key_path = os.path.join(self._sign_keydir, self._sign_keyname_conf)
-        self._check_sign_key_files(sign_key_path, self._sign_algo)
-        if self._sign_individual:
-            sign_key_img_path = os.path.join(self._sign_keydir, self._sign_keyname_img)
-            self._check_sign_key_files(sign_key_img_path, self._sign_algo)
+        # Some sanity checks because mkimage exits with 0 also without needed keys.
+        # If the keydir is a PKCS#11 URI, skip this check.
+        if not self._sign_keydir.startswith('pkcs11:'):
+            sign_key_path = os.path.join(self._sign_keydir, self._sign_keyname_conf)
+            self._check_sign_key_files(sign_key_path, self._sign_algo)
+            if self._sign_individual:
+                sign_key_img_path = os.path.join(self._sign_keydir, self._sign_keyname_img)
+                self._check_sign_key_files(sign_key_img_path, self._sign_algo)
 
         cmd = [
             self._mkimage_sign,