Re: [PATCH] ARM: k3: allow to take signing key from environment variable

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi,

On 06.11.25 08:30, Sascha Hauer wrote:
> This adds a new Kconfig option CONFIG_ARCH_K3_SIGNING_KEY_ENV. With
> this option enabled the content of CONFIG_ARCH_K3_SIGNING_KEY is treated
> as the name of an environment variable from which the private key
> file/uri is taken. This allows for better integration with build
> systems.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  arch/arm/mach-k3/Kconfig |  8 ++++++++
>  images/Makefile.k3       | 12 +++++++++++-
>  2 files changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm/mach-k3/Kconfig b/arch/arm/mach-k3/Kconfig
> index ecd77d8d9a..58f6ba827d 100644
> --- a/arch/arm/mach-k3/Kconfig
> +++ b/arch/arm/mach-k3/Kconfig
> @@ -81,6 +81,14 @@ config ARCH_K3_SIGNING_KEY_CUSTOM
>  
>  endchoice
>  
> +config ARCH_K3_SIGNING_KEY_ENV
> +	bool "Specify signing key in environment"
> +	depends on ARCH_K3_SIGNING_KEY_CUSTOM
> +	help
> +	  If this option is enabled the content of CONFIG_ARCH_K3_SIGNING_KEY
> +	  is treated as name of an environment variable rather than a filename/uri
> +	  directly which allows for better integration with build systems.

Why an extra option instead of just interpreting any number of __ENV_something
as environment variable ${something} as we already do for CONFIG_CRYPTO_PUBLIC_KEYS?

Cheers,
Ahmad

> +
>  config ARCH_K3_SIGNING_KEY
>  	string "Signing key"
>  	depends on ARCH_K3_SIGNING_KEY_CUSTOM
> diff --git a/images/Makefile.k3 b/images/Makefile.k3
> index 1a8bfe641a..9de48f4d2b 100644
> --- a/images/Makefile.k3
> +++ b/images/Makefile.k3
> @@ -17,10 +17,20 @@ image-$(CONFIG_MACH_BEAGLEPLAY) += barebox-beagleplay.img
>  
>  endif
>  
> +
> +
>  ifdef CONFIG_ARCH_K3_SIGNING_KEY_TI_DEVEL
>  KEY_custmpk=$(srctree)/arch/arm/mach-k3/custMpk.pem
>  else
> -KEY_custmpk="$(CONFIG_ARCH_K3_SIGNING_KEY)"
> +
> +k3_sigining_key=$(call remove_quotes,$(CONFIG_ARCH_K3_SIGNING_KEY))
> +
> +ifeq ($(CONFIG_ARCH_K3_SIGNING_KEY_ENV),y)
> +KEY_custmpk=$(shell echo $$$(k3_sigining_key))
> +else
> +KEY_custmpk=$(k3_sigining_key)
> +endif
> +
>  endif
>  KEY_degenerate=$(srctree)/arch/arm/mach-k3/ti-degenerate-key.pem
>  


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |