u-boot.git/test/py/tests/vboot, branch next

tools: fit: sign all config image references

2026-08-25T23:12:40Z

Target-side configuration verification builds the signed-region list from every image-reference property in the selected configuration. Host-side signing still uses either the signature node sign-images property or the legacy kernel/fdt/script default list. This lets mkimage generate configuration signatures which U-Boot cannot verify when the configuration references other image types, such as firmware, loadables or ramdisk entries. It also lets the host and target disagree when sign-images names only a subset of the configuration images. Build the host-side signing list from the configuration properties in the same way as target-side verification. Use one shared property classifier so the host and target cannot drift apart again. This makes signed configurations cover the root node, the configuration node, every referenced image node, and its hash, cipher and dm-verity subnodes, regardless of image type. Warn when a legacy sign-images property is present, since it no longer limits the signed image list. Require every referenced image to have at least one hash subnode. Add sandbox coverage proving that a firmware reference omitted from sign-images is still recorded in hashed-nodes and verified. Update the signed-configuration documentation to describe the same rule and the hash-subnode requirement. Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list") Signed-off-by: James Hilliard Reviewed-by: Simon Glass

test: py: vboot: add test for global image signature

2022-03-31T18:12:23Z

Adds test units for the pre-load header signature. Signed-off-by: Philippe Reynes

arch: Kconfig: imply BINMAN for SANDBOX

2022-03-31T18:12:01Z

To be able to use the tool binman on sandbox, the config SANDBOX should imply BINMAN. Reviewed-by: Simon Glass Signed-off-by: Philippe Reynes

test/py: Add test case for mkimage -o argument

2022-02-11T15:52:24Z

Stress the '-o algo_name' argument of mkimage by expanding the vboot test. Signed-off-by: Jan Kiszka Reviewed-by: Simon Glass [trini: Update scripts/pylint.base]

rsa: adds rsa3072 algorithm

2022-01-28T22:58:41Z

Add to support rsa 3072 bits algorithm in tools for image sign at host side and adds rsa 3072 bits verification in the image binary. Add test case in vboot for sha384 with rsa3072 algorithm testing. Signed-off-by: Jamin Lin Reviewed-by: Simon Glass

test/py: Check hashes produced by mkimage against known values

2021-10-05T12:50:15Z

Target code and mkimage share the same hashing infrastructure. If one is wrong, it's very likely that both are wrong in the same way. Thus testing won't catch hash regressions. This already happened in commit 92055e138f28 ("image: Drop if/elseif hash selection in calculate_hash()"). None of the tests caught that CRC32 was broken. Instead of testing hash_calculate() against itself, create a FIT with containing a kernel with pre-calculated hashes. Then check the hashes produced against the known good hashes. Signed-off-by: Alexandru Gagniuc Reviewed-by: Simon Glass

pytest: vboot: add a test for required key

2019-10-15T14:40:02Z

This commit add a test in the vboot test to check that when a required key is asked, only FIT signed with this key is used/accepted by u-boot. Signed-off-by: Philippe Reynes

test: vboot: clean its file

2018-12-03T15:44:10Z

This update the its file used in vboot test to respect the new node style name defined in doc/uImage.FIT (for example: replace kernel@1 by kernel and fdt@1 by fdt-1) Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass

test: vboot: add padding pss for rsa signature

2018-12-03T15:44:10Z

The padding pss is now supported for rsa signature. This add test with padding pss on vboot test. Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass

test: Convert the vboot test to test/py

2016-07-14T22:22:40Z

Now that we have a suitable test framework we should move all tests into it. The vboot test is a suitable candidate. Rewrite it in Python and move the data files into an appropriate directory. Signed-off-by: Simon Glass