From: Simon Glass <sjg@chromium.org>
Date: Wed, 24 Feb 2016 16:14:43 +0000 (-0700)
Subject: Revert "image-fit: Fix signature checking"
X-Git-Tag: v2016.03-rc3~9^2~15
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=2e33e761656f30651ed9ae16ecdbd5117d51d7d2;p=u-boot

Revert "image-fit: Fix signature checking"

This reverts commit 84ca65aa4bd0d03867e9e49805201d0564d3ffb0.

On signature verification failures fit_image_verify() should NOT exit with
error. Only keys marked 'required' can cause image verification failure.
This logic is already there and works correctly.

Add a comment to make this clear.

Fixes: 84ca65aa (image-fit: Fix signature checking)
Signed-off-by: Simon Glass <sjg@chromium.org>
---

diff --git a/common/image-fit.c b/common/image-fit.c
index d3fad30c34..fbd9e0d770 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -1035,10 +1035,15 @@ int fit_image_verify(const void *fit, int image_noffset)
 					strlen(FIT_SIG_NODENAME))) {
 			ret = fit_image_check_sig(fit, noffset, data,
 							size, -1, &err_msg);
-			if (ret) {
+
+			/*
+			 * Show an indication on failure, but do not return
+			 * an error. Only keys marked 'required' can cause
+			 * an image validation failure. See the call to
+			 * fit_image_verify_required_sigs() above.
+			 */
+			if (ret)
 				puts("- ");
-				goto error;
-			}
 			else
 				puts("+ ");
 		}