arm: mach-omap2: Fix secure file generation

PATCH New Andrew F. Davis 2 participants 10 messages Dec 8, 2016 – Dec 12, 2016

Subsystems (3)

Arm (32-bit) Arm sub-architectures OMAP2+ support

lore

Share & tools

lore

Andrew F. Davis

author

2016-12-08 22:48 UTC #0 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.

Signed-off-by Andrew F. Davis <[email protected]>

---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

arch/arm/mach-omap2/config_secure.mk +2 -2

index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif

Signature · 1 line

2.10.2

Tom Rini

2016-12-08 23:22 UTC #1 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 8 lines · Andrew F. Davis

When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>

Reviewed-by Tom Rini <[email protected]>

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161208/a1752504/attachment.sig>

Tom Rini

2016-12-09 19:59 UTC #2 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

In reply to Andrew F. Davis

Quoted 21 lines · Andrew F. Davis

When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \

arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45

Quoted 10 lines

arch/arm/mach-omap2/config_secure.mk +2 -2

-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif

OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:

       arm:  +   am57xx_hs_evm

+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory +(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2

So perhaps we need to make use of some other logic to rebuild on TI_SECURE_DEV_PKG changing?

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161209/7ce87fd0/attachment.sig>

Andrew F. Davis

author

2016-12-09 20:05 UTC #3 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 38 lines · Tom Rini

Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm

Review

Quoted 4 lines

(quoted diff) +4 -0

+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2

Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.

Quoted 3 lines

So perhaps we need to make use of some other logic to rebuild on TI_SECURE_DEV_PKG changing?

Tom Rini

2016-12-09 20:10 UTC #4 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 39 lines · Andrew F. Davis

Quoted 38 lines · Tom Rini
Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm
+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory

Quoted 8 lines

Review
Quoted 3 lines
(quoted diff) +3 -0
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2
Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.

Well, I suppose this is a valid question. I run into it failing as I (and travis-ci) build all ARM targets. Maybe we can have the build not happen (and echo a Warning) and then not invoke mkimage later on if the env isn't right?

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161209/149129ab/attachment.sig>

Andrew F. Davis

author

2016-12-09 20:24 UTC #5 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 49 lines · Tom Rini

Quoted 39 lines · Andrew F. Davis
Quoted 38 lines · Tom Rini
Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm
+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory
Quoted 8 lines
Review
Quoted 3 lines
(quoted diff) +3 -0
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2
Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.

Quoted 5 lines

Well, I suppose this is a valid question. I run into it failing as I (and travis-ci) build all ARM targets. Maybe we can have the build not happen (and echo a Warning) and then not invoke mkimage later on if the env isn't right?

For test building you can export TI_SECURE_DEV_PKG to point to a dummy signing tool which just runs cp $1 $2. For real world building this tool is needed just as much as the compiler, if you don't have it you will not build working images, build needs to fail here.

Tom Rini

2016-12-09 21:30 UTC #6 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 55 lines · Andrew F. Davis

Quoted 49 lines · Tom Rini
Quoted 39 lines · Andrew F. Davis
Quoted 38 lines · Tom Rini
Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm
+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory
Quoted 8 lines
Review
Quoted 3 lines
(quoted diff) +3 -0
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2
Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.
Quoted 4 lines
Well, I suppose this is a valid question. I run into it failing as I (and travis-ci) build all ARM targets. Maybe we can have the build not happen (and echo a Warning) and then not invoke mkimage later on if the env isn't right?

Quoted 4 lines

For test building you can export TI_SECURE_DEV_PKG to point to a dummy signing tool which just runs cp $1 $2. For real world building this tool is needed just as much as the compiler, if you don't have it you will not build working images, build needs to fail here.

Hmmm, OK. But can we not automate that based on TI_SECURE_DEV_PKG being unset?

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161209/5984f608/attachment.sig>

Andrew F. Davis

author

2016-12-09 21:39 UTC #7 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 56 lines · Tom Rini

Quoted 55 lines · Andrew F. Davis
Quoted 53 lines · Tom Rini
Quoted 39 lines · Andrew F. Davis
Quoted 38 lines · Tom Rini
Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm
+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory
Quoted 8 lines
Review
Quoted 3 lines
(quoted diff) +3 -0
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2
Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.
Well, I suppose this is a valid question. I run into it failing as I (and travis-ci) build all ARM targets. Maybe we can have the build not happen (and echo a Warning) and then not invoke mkimage later on if the env isn't right?

Quoted 8 lines

Quoted 4 lines
For test building you can export TI_SECURE_DEV_PKG to point to a dummy signing tool which just runs cp $1 $2. For real world building this tool is needed just as much as the compiler, if you don't have it you will not build working images, build needs to fail here.
Hmmm, OK. But can we not automate that based on TI_SECURE_DEV_PKG being unset?

That is what we already do, if TI_SECURE_DEV_PKG is unset, build should fail, but right now it fakes a successful build, most likely to keep the auto-validation happy as it does not have the signing tool.

The only other thing I can think of is to always try to sign the images, even when they have not changed on disk since the last build. Would this be acceptable?

Tom Rini

2016-12-12 15:30 UTC #8 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

Quoted 66 lines · Andrew F. Davis

Quoted 56 lines · Tom Rini
Quoted 55 lines · Andrew F. Davis
Quoted 53 lines · Tom Rini
Quoted 39 lines · Andrew F. Davis
Quoted 38 lines · Tom Rini
Quoted 21 lines · Andrew F. Davis
When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>
---
 arch/arm/mach-omap2/config_secure.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-omap2/config_secure.mk +0 -0
index 1122439..33c7059 100644
@@ -35,12 +35,12 @@ cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \
 else
 cmd_omapsecureimg = echo "WARNING:" \
 	"$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \
arch/arm/mach-omap2/config_secure.mk cmd_omapsecureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ · line 45
Quoted 10 lines
arch/arm/mach-omap2/config_secure.mk +2 -2
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 else
 cmd_omapsecureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \
 	"variable must be defined for TI secure devices." \
-	"$@ was NOT created!"; cp $< $@
+	"$@ was NOT created!";
 endif
 endif
OK, but now that I build test this (without the tools present) this is a NAK. The root problem is that if we don't make that dummy file we then:
       arm:  +   am57xx_hs_evm
+(am57xx_hs_evm) ./tools/mkimage: Can't open u-boot-nodtb_HS.bin: No such file or directory
Quoted 8 lines
Review
Quoted 3 lines
(quoted diff) +3 -0
+(am57xx_hs_evm) ./tools/mkimage: failed to build FIT
+(am57xx_hs_evm) make[1]: *** [u-boot_HS.img] Error 1
+(am57xx_hs_evm) make: *** [sub-make] Error 2
Is this not okay? build *should* fail if TI_SECURE_DEV_PKG is not defined. You cannot sign images that *need* to be signed to work on this platform, making a fake un-bootable image instead of failing is a hack and it confuses the make system when you do put the signing tool in-place.
Well, I suppose this is a valid question. I run into it failing as I (and travis-ci) build all ARM targets. Maybe we can have the build not happen (and echo a Warning) and then not invoke mkimage later on if the env isn't right?
Quoted 8 lines
Quoted 4 lines
For test building you can export TI_SECURE_DEV_PKG to point to a dummy signing tool which just runs cp $1 $2. For real world building this tool is needed just as much as the compiler, if you don't have it you will not build working images, build needs to fail here.
Hmmm, OK. But can we not automate that based on TI_SECURE_DEV_PKG being unset?

Quoted 7 lines

That is what we already do, if TI_SECURE_DEV_PKG is unset, build should fail, but right now it fakes a successful build, most likely to keep the auto-validation happy as it does not have the signing tool.
The only other thing I can think of is to always try to sign the images, even when they have not changed on disk since the last build. Would this be acceptable?

Along with a comment above it about why we always re-sign, yes, lets go that route. Thanks!

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161212/e6404776/attachment.sig>

Tom Rini

2016-12-12 13:47 UTC #9 lore raw

PATCH 1/1 arm: mach-omap2: Fix secure file generation

In reply to Andrew F. Davis

Quoted 9 lines · Andrew F. Davis

When TI_SECURE_DEV_PKG is not defined we warn that the file '*_HS' was not generated but generate an unsigned one anyway. When TI_SECURE_DEV_PKG is exported and the user re-builds, make will detect this file as unchangedand and so assume it does not need to be re-generated. This causes it to pack unsigned files. Fix this by not generating these fake unsigned *_HS files.
Signed-off-by Andrew F. Davis <[email protected]>
Reviewed-by Tom Rini <[email protected]>

Applied to u-boot/master, thanks!

Signature · 8 lines

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20161212/4541457f/attachment.sig>