[1/3] tools: binman: Test signing an encrypted FIT with a preload header

[Simon Glass]

Hi Paul,

On 2026-04-01T15:35:23, yan wang <yan.wang at softathome.com> wrote:
> tools: binman: Test signing an encrypted FIT with a preload header
> tools: binman: Test signing an encrypted FIT with a preload header
>
> This test is added to work on issue currently faced with binman.
> Binman calls multiple times mkimage and thus generates the FIT multiple
> times and the last call happens after the preload header has been
> generated. When encrypting the image with a random IV or if the timestamp
> in the FIT has changed between the 2 last calls of mkimage, the preload
> header would not sign the correct data leading to a corrupted image.
>
> Signed-off-by: Paul HENRYS <paul.henrys_ext at softathome.com>

> diff --git a/tools/binman/test/336_pre_load_fit_encrypted.dts b/tools/binman/test/336_pre_load_fit_encrypted.dts
> new file mode 100644

Test file number 336 is already in use by 336_symbols_base.dts. Please
can you renumber this to use the next available number (351).

> diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py
> @@ -5894,6 +5894,23 @@ fdt         fdtmap                Extract the devicetree blob from the fdtmap
> +    def testPreLoadEncryptedFit(self):
> +        """Test an encrypted FIT image with a pre-load header"""

The commit message says this test is added to "work on" an issue, but
it doesn't clearly explain that this test exposes a bug fixed by later
patches in the series. Please can you clarify in the commit message
that this test would fail without patches 2/3 and why? Something like
"Add a test to verify the preload header correctly signs an encrypted
FIT. This test exercises the case where encryption uses random IVs
that would change between mkimage calls."

Regards,
Simon