Re: [PATCH 14/15] doc/barebox-tlv: Update documentation regarding TLV-Signature

[Jonas Rebmann <jre@pengutronix.de>]

Hi,

On 2025-10-14 13:03, Jonas Rebmann wrote:
>   - Update the data structure documentation
>   - Explain the signature scheme
>   - Add signature to bareboxtlv-generator usage description

I forgot to update the kconfig help for CRYPTO_BUILTIN_KEYS. In v2 I
would include in this documentation patch the change to:

   This option should be a space separated list of filenames of public
   key specifications. While other syntaxes are supported for legacy
   reasons, each entry should have the format
   keyring=<keyring>[,fit-hint=<hint>]:<crt>
   
   <keyring> specifies the keyring for the key to be included in (e.g.
   "fit" if this key is to be used for fitimage verification).
   
   <fit-hint> is used as a key name hint for fitimage verificaiton to
   find a key without iterating over all keys.
   
   <crt> specifies the path of a public key to be included in barebox.
   It can be a PEM-formatted file containing an X.509 certificate. If a
   certificate path starts with "pkcs11:" it is interpreted as a PKCS#11
   URI rather than a file.
   
   Placeholders such as __ENV__VAR_NAME can be used to look up the
   corresponding value in the environment variable VAR_NAME for public
   key paths/URIs as well as key name hints.
   
   Examples specified directly:
   
   - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit:pkcs11:object=foo"
   - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=myhint:pkcs11:object=foo"
   - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=myhint:pkcs11:object=foo keyring=fit:/foobar/baz.der"
   - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=myhint:pkcs11:object=foo keyring=fit,fit-hint=myotherhint:/foobar/baz.der"
   
   Example specified indirectly by two environment variables:
   
   - myhint="myhint"
   - myname="pkcs11:object=foo" (.der could be used too)
   - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=__ENV__myhint:__ENV__myname"
   
   Example specified indirectly by a single environment variable:
   
   - mykey="keyring=fit,fit-hint=myhint:pkcs11:object=foo" (.der could be used too)
   - CONFIG_CRYPTO_PUBLIC_KEYS="__ENV__mykey"


Regards,
Jonas

-- 
Pengutronix e.K.                           | Jonas Rebmann               |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |