uboot-sign: Support signing U-Boot FIT image without SPL

Previously, the signing flow in "uboot-sign.bbclass" assumed that SPL was always
present and that the FIT signing process must inject the public key into the
SPL DTB. This made it inflexible for use cases where only the U-Boot proper
FIT image is built and signed, with no SPL binary at all.

This change introduces the following adjustments:
- The `SPL_DTB_BINARY` variable can be explicitly set to an empty string
  to indicate that no SPL is present.
- The signing logic checks `SPL_DTB_BINARY` and skips injecting the
  key or verifying the SPL DTB if it is empty.
- The FIT image generation and deployment are always performed if
  `UBOOT_FITIMAGE_ENABLE` is enabled, regardless of the SPL settings.
- The deploy helper now uses a single check on `SPL_DTB_BINARY` to decide
  whether to deploy the signed SPL DTB.

Now the sign step checks if SPL_DTB_BINARY is empty:
If present, it signs the FIT image and injects the public key into the SPL DTB,
then verifies both.
If empty, it only signs the FIT image and generates the ITS with the signature
node, but does not attempt to verify or add the key to a non-existent SPL DTB.

Key Behavior Explained
If SPL_DTB_BINARY is empty, we assume there is no SPL.
If UBOOT_FITIMAGE_ENABLE=1, we always create the FIT image and ITS.
If SPL_SIGN_ENABLE=1, we always sign the FIT image, but only inject the key into
the SPL DTB if it exists.

Example usage:
  UBOOT_FITIMAGE_ENABLE = "1"
  SPL_SIGN_ENABLE = "1"
  SPL_DTB_BINARY = ""

This means:
  - Generate and sign the FIT image.
  - Do not attempt to sign or deploy an SPL DTB.

This aligns the implementation with real scenarios where some boards do not
require an SPL.

(From OE-Core rev: 7ad6acd8841752a5b75b8e2666bca5b609347cc1)

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 29 insertions, 21 deletions

diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 73e9ce3f11..01c53c7448 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -50,6 +50,8 @@ UBOOT_FITIMAGE_BINARY ?= "u-boot-fitImage"
 UBOOT_FITIMAGE_SYMLINK ?= "u-boot-fitImage-${MACHINE}"
 SPL_DIR ?= "spl"
 SPL_DTB_IMAGE ?= "u-boot-spl-${MACHINE}-${PV}-${PR}.dtb"
+# When SPL is not used, set SPL_DTB_BINARY ?= "" to explicitly indicate
+# that no SPL DTB should be created or signed.
 SPL_DTB_BINARY ?= "u-boot-spl.dtb"
 SPL_DTB_SIGNED ?= "${SPL_DTB_BINARY}-signed"
 SPL_DTB_SYMLINK ?= "u-boot-spl-${MACHINE}.dtb"
@@ -466,25 +468,31 @@ EOF
                 ${UBOOT_FITIMAGE_BINARY}
 
         if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
-                #
-                # Sign the U-boot FIT image and add public key to SPL dtb
-                #
-                ${UBOOT_MKIMAGE_SIGN} \
-                        ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
-                        -F -k "${SPL_SIGN_KEYDIR}" \
-                        -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
-                        -r ${UBOOT_FITIMAGE_BINARY} \
-                        ${SPL_MKIMAGE_SIGN_ARGS}
-                #
-                # Verify the U-boot FIT image and SPL dtb
-                #
-                ${UBOOT_FIT_CHECK_SIGN} \
-                        -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
-                        -f ${UBOOT_FITIMAGE_BINARY}
-        fi
+                if [ -n "${SPL_DTB_BINARY}" ] ; then
+                        #
+                        # Sign the U-boot FIT image and add public key to SPL dtb
+                        #
+                        ${UBOOT_MKIMAGE_SIGN} \
+                                ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
+                                -F -k "${SPL_SIGN_KEYDIR}" \
+                                -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                                -r ${UBOOT_FITIMAGE_BINARY} \
+                                ${SPL_MKIMAGE_SIGN_ARGS}
 
-        if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ]; then
-                cp ${SPL_DIR}/${SPL_DTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED}
+                        # Verify the U-boot FIT image and SPL dtb
+                        ${UBOOT_FIT_CHECK_SIGN} \
+                                -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                                -f ${UBOOT_FITIMAGE_BINARY}
+
+                        cp ${SPL_DIR}/${SPL_DTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED}
+                else
+                        # Sign the U-boot FIT image
+                        ${UBOOT_MKIMAGE_SIGN} \
+                                ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
+                                -F -k "${SPL_SIGN_KEYDIR}" \
+                                -r ${UBOOT_FITIMAGE_BINARY} \
+                                ${SPL_MKIMAGE_SIGN_ARGS}
+                fi
         fi
 }
 
@@ -496,7 +504,7 @@ uboot_assemble_fitimage_helper() {
                 concat_dtb "$type" "$binary"
         fi
 
-        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
+        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ]; then
                 uboot_fitimage_assemble
         fi
 
@@ -543,7 +551,7 @@ deploy_helper() {
                 deploy_dtb $type
         fi
 
-        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
+        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ]; then
                 if [ -n "${type}" ]; then
                         uboot_its_image="u-boot-its-${type}-${PV}-${PR}"
                         uboot_fitimage_image="u-boot-fitImage-${type}-${PV}-${PR}"
@@ -561,7 +569,7 @@ deploy_helper() {
                 fi
         fi
 
-        if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_SIGNED}" ] ; then
+        if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
                 deploy_spl_dtb $type
         fi
 }