u-boot.git/tools/binman, branch next

test: binman: Add test for pkcs11 signed capsule

2026-03-18T12:14:17+00:00

Test pkcs11 URI support for UEFI capsule generation. Both
public certificate and private key are used over pkcs11
protocol.
Pkcs11-tool has been introduced as softhsm tool doesn't have
functionality to import certificates in commonly distributed
version (only in the latest).

Signed-off-by: Wojciech Dubowik 
Reviewed-by: Simon Glass

binman: DTS: Add dump-signature option for capsules

2026-03-18T12:14:17+00:00

Mkeficapsule can dump signature for signed capsules. It can
be used in test to validate signature i.e. with openssl.
Add an entry for device tree node.

Signed-off-by: Wojciech Dubowik 
Reviewed-by: Simon Glass

binman: Add dump signature option to mkeficapsule

2026-03-18T12:14:17+00:00

It will be used to capsule signature verification.

Signed-off-by: Wojciech Dubowik 
Reviewed-by: Simon Glass

tools: mkeficapsule: Fix dump signature long option

2026-03-18T12:14:17+00:00

Only short option has been present. Also rename dump_sig
to dump-sig to match with other parameter names.

Fixes: 16abff246b40 ("tools: mkeficapsule: add firmware image signing")

Signed-off-by: Wojciech Dubowik 
Reviewed-by: Ilias Apalodimas

binman: Accept pkcs11 URI tokens for capsule updates

2026-03-18T12:14:17+00:00

With pkcs11 support in mkeficapsule we can now accept URI
tokens and not only files.

Signed-off-by: Wojciech Dubowik 
Reviewed-by: Simon Glass

binman: Remove the coverage allow_failures list

2026-03-18T12:14:16+00:00

Now that iMX8 has full coverage the allow_failures list in
RunTestCoverage() is no longer needed.

Drop the list.

Signed-off-by: Simon Glass

binman: test: Fix code coverage for iMX8 and cst bintool

2026-03-18T12:14:16+00:00

Three files are currently missing test coverage: nxp_imx8mcst,
nxp_imx8mimage and cst

Add test methods to cover all missing code paths, trying to reuse the
same .dts files where possible.

This brings all three files to 100% coverage.

Signed-off-by: Simon Glass

binman: test: Move shared key files to test/security/

2026-03-18T12:14:16+00:00

Move key.key and key.pem into the security/ subdirectory. These are
used by security, vendor, and capsule tests but security is the most
natural home for key material. Update all references.

Signed-off-by: Simon Glass

binman: test: Move FIT signing test data to test/fit/

2026-03-18T12:14:16+00:00

Move the signing-related test data (keys, certificates, OpenSSL and
SoftHSM2 configuration, dummy engine source) into the fit/ subdirectory
alongside the FIT DTS test files. Drop the 340_ prefix from files that
had it. Update the Makefile and all ftest.py references.

Signed-off-by: Simon Glass

binman: test: Move x86 binary test data to test/x86/

2026-03-18T12:14:16+00:00

Move descriptor.bin, fitimage.bin.gz and ifwi.bin.gz into the x86/
subdirectory alongside the x86 DTS test files and update all
references.

Signed-off-by: Simon Glass