[PATCH] tools: binman: add build key directory option

[Simon Glass]

Hi James,

On 2026-07-03T21:33:03, James Hilliard <james.hilliard1 at gmail.com> wrote:
> tools: binman: add build key directory option
>
> U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but
> internal binman builds only received the generic BINMAN_INDIRS search
> path. FIT entries with fit,sign or fit,encrypt therefore had to infer
> the key directory from include directories before invoking mkimage -k.
>
> Add a binman build -k/--keydir option and pass KEYDIR through with
> that option from the top-level Makefile. FIT entries prefer this key
> directory over include-dir discovery and then pass it to mkimage -k.
>
> Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
>
> Makefile                  |  1 +
>  tools/binman/binman.rst   | 10 +++++++++-
>  tools/binman/cmdline.py   |  2 ++
>  tools/binman/control.py   |  1 +
>  tools/binman/etype/fit.py | 24 +++++++++++++---------
>  tools/binman/ftest.py     | 51 ++++++++++++++++++++++++++++++++++++++++++++---
>  tools/binman/state.py     | 21 +++++++++++++++++++
>  7 files changed, 97 insertions(+), 13 deletions(-)

> diff --git a/tools/binman/state.py b/tools/binman/state.py
> @@ -41,6 +41,9 @@ fdt_path_prefix = ''
>  # Arguments passed to binman to provide arguments to entries
>  entry_args = {}
>
> +# Directory containing keys for FIT signing/encryption
> +keydir = None
> +

Please use the existing EntryArg mechanism instead (see
etype/vblock.py and etype/gbb.py). Then cmdline.py, control.py and
state.py need no changes - fit.py declares EntryArg('keydir', str) and
reads it, and the Makefile passes '-a keydir=$(KEYDIR)' alongside the
other -a args. That matches how atf-bl31-path, tee-os-path, of-list
etc. are handled.

> diff --git a/tools/binman/etype/fit.py b/tools/binman/etype/fit.py
> @@ -500,6 +505,7 @@ class Entry_fit(Entry_section):
>          self._fit_list_prop = None
>          self._fit_default_dt = None
>          self._priv_entries = {}
> +        self._keydir = state.GetKeydir()

Reading global state in __init__ makes this harder to test and couples
the entry to a module-level variable. If EntryArg is not used, please
fetch it lazily in ObtainContents() next to the existing engine/keydir
logic.

> diff --git a/tools/binman/binman.rst b/tools/binman/binman.rst
> @@ -2161,6 +2164,11 @@ BINMAN_INDIRS
>
> +KEYDIR
> +    Sets the key directory passed to FIT entries by adding a -k argument.
> +    FIT entries use this directory for mkimage's -k argument when fit,sign
> +    or fit,encrypt is enabled.
> +

This section is for binman env vars, but KEYDIR is a make variable the
Makefile forwards. Please clarify, or drop this hunk if EntryArg is
used.

Regards,
Simon