binman: implement signing FIT images during image build
The patch implement new property 'fit,sign' that can be declared
at the top-level 'fit' node. If that option is declared, fit tryies
to detect private keys directory among binman include directories.
That directory than passed to mkimage using '-k' flag and that enable
signing of FIT.
Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Renumbered files, moved new tests to end:
Signed-off-by: Simon Glass <sjg@chromium.org>
diff --git a/tools/binman/entries.rst b/tools/binman/entries.rst
index 3006c59..e918162 100644
--- a/tools/binman/entries.rst
+++ b/tools/binman/entries.rst
@@ -864,6 +864,13 @@
fit,fdt-list-dir = "arch/arm/dts
+ fit,sign
+ Enable signing FIT images via mkimage as described in
+ verified-boot.rst. If the property is found, the private keys path is
+ detected among binman include directories and passed to mkimage via
+ -k flag. All the keys required for signing FIT must be available at
+ time of signing and must be located in single include directory.
+
Substitutions
~~~~~~~~~~~~~