[PATCH] tools: binman: add build key directory option
Quentin Schulz
quentin.schulz at cherry.de
Mon Jul 6 10:51:08 CEST 2026
Hi James,
On 7/3/26 11:33 PM, James Hilliard wrote:
> U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but
> internal binman builds only received the generic BINMAN_INDIRS search
> path. FIT entries with fit,sign or fit,encrypt therefore had to infer
> the key directory from include directories before invoking mkimage -k.
>
You don't explain why that is an issue? Simply add KEYDIR to BINMAN_INDIRS?
> Add a binman build -k/--keydir option and pass KEYDIR through with
> that option from the top-level Makefile. FIT entries prefer this key
> directory over include-dir discovery and then pass it to mkimage -k.
>
> Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
> ---
> Makefile | 1 +
> tools/binman/binman.rst | 10 +++++++-
> tools/binman/cmdline.py | 2 ++
> tools/binman/control.py | 1 +
> tools/binman/etype/fit.py | 24 +++++++++++-------
> tools/binman/ftest.py | 51 ++++++++++++++++++++++++++++++++++++---
> tools/binman/state.py | 21 ++++++++++++++++
> 7 files changed, 97 insertions(+), 13 deletions(-)
>
> diff --git a/Makefile b/Makefile
> index d8287323c43..27be2a81e83 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -1689,6 +1689,7 @@ cmd_binman = $(srctree)/tools/binman/binman $(if $(BINMAN_DEBUG),-D) \
> -I . -I $(srctree)/board/$(BOARDDIR) -I $(srctree) \
> $(foreach f,$(of_list_dirs),-I $(f)) -a of-list=$(of_list) \
> $(foreach f,$(BINMAN_INDIRS),-I $(f)) \
> + $(if $(KEYDIR),-k $(KEYDIR)) \
> -a atf-bl1-path=${BL1} \
> -a atf-bl31-path=${BL31} \
> -a tee-os-path=${TEE} \
> diff --git a/tools/binman/binman.rst b/tools/binman/binman.rst
> index 366491089ad..8770b279ff8 100644
> --- a/tools/binman/binman.rst
> +++ b/tools/binman/binman.rst
> @@ -1711,7 +1711,7 @@ Usage::
>
> binman build [-h] [-a ENTRY_ARG] [-b BOARD] [-d DT] [--fake-dtb]
> [--fake-ext-blobs] [--force-missing-bintools FORCE_MISSING_BINTOOLS]
> - [-i IMAGE] [-I INDIR] [-m] [-M] [-n] [-O OUTDIR] [-p] [-u]
> + [-i IMAGE] [-I INDIR] [-k KEYDIR] [-m] [-M] [-n] [-O OUTDIR] [-p] [-u]
> [--update-fdt-in-elf UPDATE_FDT_IN_ELF] [-W]
>
> Options:
> @@ -1738,6 +1738,9 @@ Options:
> Add a path to the list of directories to use for input files. This can be
> specified multiple times to add more than one path.
>
> +-k KEYDIR, --keydir KEYDIR
> + Directory containing keys for signing/encryption.
> +
> -m, --map
> Output a map file for each image. See `Map files`_.
>
> @@ -2161,6 +2164,11 @@ BINMAN_INDIRS
> Sets the search path for input files used by binman by adding one or more
> `-I` arguments. See :ref:`External blobs`.
>
> +KEYDIR
> + Sets the key directory passed to FIT entries by adding a `-k` argument.
> + FIT entries use this directory for mkimage's `-k` argument when `fit,sign`
> + or `fit,encrypt` is enabled.
> +
> BINMAN_TOOLPATHS
> Sets the search path for external tool used by binman by adding one or more
> `--toolpath` arguments. See :ref:`External tools`.
> diff --git a/tools/binman/cmdline.py b/tools/binman/cmdline.py
> index 9632ec115e5..cd4d05dfb69 100644
> --- a/tools/binman/cmdline.py
> +++ b/tools/binman/cmdline.py
> @@ -128,6 +128,8 @@ controlled by a description in the board device tree.'''
> help='Image filename to build (if not specified, build all)')
> build_parser.add_argument('-I', '--indir', action='append',
> help='Add a path to the list of directories to use for input files')
> + build_parser.add_argument('-k', '--keydir', type=str,
> + help='Directory containing keys for signing/encryption')
> build_parser.add_argument('-m', '--map', action='store_true',
> default=False, help='Output a map file for each image')
> build_parser.add_argument('-M', '--allow-missing', action='store_true',
> diff --git a/tools/binman/control.py b/tools/binman/control.py
> index 816f7c1eba2..84586d1baf1 100644
> --- a/tools/binman/control.py
> +++ b/tools/binman/control.py
> @@ -923,6 +923,7 @@ def Binman(args):
> tools.set_input_dirs(args.indir)
> tools.prepare_output_dir(args.outdir, args.preserve)
> state.SetEntryArgs(args.entry_arg)
> + state.SetKeydir(args.keydir)
> state.SetThreads(args.threads)
>
> images = PrepareImagesAndDtbs(dtb_fname, args.image,
> diff --git a/tools/binman/etype/fit.py b/tools/binman/etype/fit.py
> index f28b1e6b4cb..404e33d3022 100644
> --- a/tools/binman/etype/fit.py
> +++ b/tools/binman/etype/fit.py
> @@ -14,6 +14,7 @@ import os
> from binman.entry import Entry, EntryArg
> from binman.etype.section import Entry_section
> from binman import elf
> +from binman import state
> from dtoc import fdt_util
> from dtoc.fdt import Fdt
> from u_boot_pylib import tools
> @@ -105,18 +106,20 @@ class Entry_fit(Entry_section):
> fit,sign
> Enable signing FIT images via mkimage as described in
> verified-boot.rst.
> - If the property is found and fit,engine is not set, the private
> - keys path is detected among binman include directories and passed to
> - mkimage via -k flag. All the keys required for signing FIT must be
> - available at time of signing and must be located in single include
> - directory.
> + If the property is found and fit,engine is not set, the key
> + directory passed with binman build -k is passed to mkimage via the
> + -k flag. If no key directory is provided, the private keys path is
> + detected among binman include directories. All the keys required for
> + signing FIT must be available at time of signing and must be
> + located in a single directory.
>
> fit,encrypt
> Enable data encryption in FIT images via mkimage. If the property
> - is found, the keys path is detected among binman include
> - directories and passed to mkimage via -k flag. All the keys
> + is found, the key directory passed with binman build -k is passed
> + to mkimage via the -k flag. If no key directory is provided, the
> + keys path is detected among binman include directories. All the keys
> required for encrypting the FIT must be available at the time of
> - encrypting and must be located in a single include directory.
> + encrypting and must be located in a single directory.
>
> Incompatible with fit,engine.
>
> @@ -485,6 +488,8 @@ class Entry_fit(Entry_section):
> includes 'generator' entries which are used to create the FIT,
> but should not be processed as real entries. This is set up once
> we have the entries
> + _keydir (str): Key directory from the binman build -k option, if
> + provided
> _loadables (list of str): List of generated split-elf nodes, each
> a node name
> _remove_props (list of str): Value of of-spl-remove-props EntryArg,
> @@ -500,6 +505,7 @@ class Entry_fit(Entry_section):
> self._fit_list_prop = None
> self._fit_default_dt = None
> self._priv_entries = {}
> + self._keydir = state.GetKeydir()
> self._loadables = []
> self._remove_props = []
> props = self.GetEntryArgsOrProps(
> @@ -701,7 +707,7 @@ class Entry_fit(Entry_section):
> args.update({'engine': engine})
> # If no engine, keys must exist locally, find them
> if engine is None:
> - keydir = self._get_keys_dir(data)
> + keydir = self._keydir or self._get_keys_dir(data)
Then we don't even check if the keys exist in _keydir anymore.
Cheers,
Quentin
More information about the U-Boot
mailing list