[PATCH v3 17/17] Documentation: migration-2025.12.0: List changes to CONFIG_CRYPTO_PUBLIC_KEYS

[Jonas Rebmann <jre@pengutronix.de>]

As part of the introduction of TLV signature in public key keyrings,
there is a new interpreter for CONFIG_CRYPTO_PUBLIC_KEYS in
scripts/keytoc.c. All users should update to the new syntax and are
presented with a warning. Users with invalid characters in the legacy
syntax must change the fit-hint and will be presented with an error.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
---
 Documentation/migration-guides/migration-2025.12.0.rst | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/Documentation/migration-guides/migration-2025.12.0.rst b/Documentation/migration-guides/migration-2025.12.0.rst
index 9d368bd970..21c8d1e3f3 100644
--- a/Documentation/migration-guides/migration-2025.12.0.rst
+++ b/Documentation/migration-guides/migration-2025.12.0.rst
@@ -1,6 +1,21 @@
 Release v2025.12.0
 ==================
 
+Configuration options
+---------------------
+
+* The syntax of ``CONFIG_CRYPTO_PUBLIC_KEYS`` was updated with the introduction
+  of the keyring feature. Previously, keys selected via
+  ``CONFIG_CRYPTO_PUBLIC_KEYS`` were only used for fitimage verification. Now,
+  fitimage verification uses the "fit" keyring. "fit" will be selected as the
+  default keyring for transition but a warning will be emitted when no keyring
+  is explicitly provided. Existing users should update their keyspec for
+  fitimage public keys to ``keyring=fit[,fit-hint=<fit_hint>]:<crt>``
+* The fit-hints in ``CONFIG_CRYPTO_PUBLIC_KEYS`` are now limited to identifiers
+  matching the regular expression ``[a-zA-Z][a-zA-Z0-9_-]*``. Public keys with
+  a ``fit-hint`` not conforming to this results in an error, affected key-hints
+  must be changed. Please reach out to the mailing list if this causes issues.
+
 Shell
 -----
 

-- 
2.51.2.535.g419c72cb8a