upstream-layers/openembedded-core/meta/conf/image-fitimage.conf - openbmc - Git at Google

 # Possible options for fitImage generation, mainly
 # related to signing of the fitImage content.

 # Description string
 FIT_DESC ?= "Kernel fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"

 # Kernel fitImage Hash Algo
 FIT_HASH_ALG ?= "sha256"

 # Kernel fitImage Signature Algo
 FIT_SIGN_ALG ?= "rsa2048"

 # Kernel / U-Boot fitImage Padding Algo
 FIT_PAD_ALG ?= "pkcs-1.5"

 # Generate keys for signing Kernel fitImage
 FIT_GENERATE_KEYS ?= "0"

 # Size of private keys in number of bits
 FIT_SIGN_NUMBITS ?= "2048"

 # args to openssl genrsa (Default is just the public exponent)
 FIT_KEY_GENRSA_ARGS ?= "-F4"

 # args to openssl req (Default is -batch for non interactive mode and
 # -new for new certificate)
 FIT_KEY_REQ_ARGS ?= "-batch -new"

 # Standard format for public key certificate
 FIT_KEY_SIGN_PKCS ?= "-x509"

 # Sign individual images as well
 FIT_SIGN_INDIVIDUAL ?= "0"

 FIT_CONF_PREFIX ?= "conf-"
 FIT_CONF_PREFIX[doc] = "Prefix to use for FIT configuration node name"

 FIT_SUPPORTED_INITRAMFS_FSTYPES ?= "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio"

 # Allow user to support special use cases where the kernel binary is
 # not included in the FIT image itself.
 # This is particularly useful for UKI-based setups, where the kernel
 # and initramfs are bundled into a Unified Kernel Image (UKI), and
 # DTBs are provided separately in a FIT image.
 FIT_LINUX_BIN ?= "linux.bin"

 # Additional mkimage options for FIT image creation
 FIT_MKIMAGE_EXTRA_OPTS ?= ""

 # Allow user to select the default DTB for FIT image when multiple dtb's exists.
 FIT_CONF_DEFAULT_DTB ?= ""

 # Allow user to specify DTB configuration node mappings.
 # The format is a space-separated list of mappings. Supported mapping types are:
 # dtb-conf:DTB_NAME:NEW_NAME         - Rename the configuration node for a DTB
 # dtb-extra-conf:DTB_NAME:EXTRA_NAME - Add an additional configuration node for a DTB
 # Example:
 #   FIT_CONF_MAPPINGS = "\
 #     dtb-extra-conf:am335x-bonegreen:bonegreen \
 #     dtb-conf:am335x-boneblack:bbblack"
 # Two DTBs (am335x-bonegreen and am335x-boneblack) result in three
 # configuration nodes: am335x-bonegreen, bonegreen, bbblack
 FIT_CONF_MAPPINGS ?= ""

 # length of address in number of <u32> cells
 # ex: 1 32bits address, 2 64bits address
 FIT_ADDRESS_CELLS ?= "1"

 # Keys used to sign individually image nodes.
 # The keys to sign image nodes must be different from those used to sign
 # configuration nodes, otherwise the "required" property, from
 # UBOOT_DTB_BINARY, will be set to "conf", because "conf" prevails on "image".
 # Then the images signature checking will not be mandatory and no error will be
 # raised in case of failure.
 # UBOOT_SIGN_IMG_KEYNAME = "dev2" # keys name in keydir (eg. "dev2.crt", "dev2.key")

 # Additional environment variables or a script which can be sourced by u-boot
 # can be packaged into the fitImage. An example is documented here:
 # https://docs.u-boot.org/en/latest/usage/cmd/source.html#fit-image
 # Machine configurations needing such a script file should include it in the
 # SRC_URI of the kernel recipe and set the FIT_UBOOT_ENV parameter.
 FIT_UBOOT_ENV ?= ""

 # Allow user to insert additional loadable images.
 # For each loadable, a number of parameters can be defined through additional
 # variable flags.
 # Example:
 #   FIT_LOADABLES = "atf"
 #   FIT_LOADABLE_FILENAME[atf] = "bl31.bin"
 #   FIT_LOADABLE_COMPRESSSION[atf] = "none"
 #   FIT_LOADABLE_DESCRIPTION[atf] = "TF-A firmware image"
 #   FIT_LOADABLE_TYPE[atf] = "tfa-bl31"
 #   FIT_LOADABLE_ARCH[atf] = "arm64"
 #   FIT_LOADABLE_OS[atf] = "arm-trusted-firmware"
 #   FIT_LOADABLE_LOADADDRESS[atf] = "0x204E0000"
 #   FIT_LOADABLE_ENTRYPOINT[atf] = "0x204E0000"
 # Sensible defalts will be used for some parameters (compression, description,
 # arch, os) if the corresponding flag is not set, while others (load address
 # and entry point) will be omitted in the final FIT.
 FIT_LOADABLES ?= ""
	# Possible options for fitImage generation, mainly
	# related to signing of the fitImage content.

	# Description string
	FIT_DESC ?= "Kernel fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"

	# Kernel fitImage Hash Algo
	FIT_HASH_ALG ?= "sha256"

	# Kernel fitImage Signature Algo
	FIT_SIGN_ALG ?= "rsa2048"

	# Kernel / U-Boot fitImage Padding Algo
	FIT_PAD_ALG ?= "pkcs-1.5"

	# Generate keys for signing Kernel fitImage
	FIT_GENERATE_KEYS ?= "0"

	# Size of private keys in number of bits
	FIT_SIGN_NUMBITS ?= "2048"

	# args to openssl genrsa (Default is just the public exponent)
	FIT_KEY_GENRSA_ARGS ?= "-F4"

	# args to openssl req (Default is -batch for non interactive mode and
	# -new for new certificate)
	FIT_KEY_REQ_ARGS ?= "-batch -new"

	# Standard format for public key certificate
	FIT_KEY_SIGN_PKCS ?= "-x509"

	# Sign individual images as well
	FIT_SIGN_INDIVIDUAL ?= "0"

	FIT_CONF_PREFIX ?= "conf-"
	FIT_CONF_PREFIX[doc] = "Prefix to use for FIT configuration node name"

	FIT_SUPPORTED_INITRAMFS_FSTYPES ?= "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio"

	# Allow user to support special use cases where the kernel binary is
	# not included in the FIT image itself.
	# This is particularly useful for UKI-based setups, where the kernel
	# and initramfs are bundled into a Unified Kernel Image (UKI), and
	# DTBs are provided separately in a FIT image.
	FIT_LINUX_BIN ?= "linux.bin"

	# Additional mkimage options for FIT image creation
	FIT_MKIMAGE_EXTRA_OPTS ?= ""

	# Allow user to select the default DTB for FIT image when multiple dtb's exists.
	FIT_CONF_DEFAULT_DTB ?= ""

	# Allow user to specify DTB configuration node mappings.
	# The format is a space-separated list of mappings. Supported mapping types are:
	# dtb-conf:DTB_NAME:NEW_NAME - Rename the configuration node for a DTB
	# dtb-extra-conf:DTB_NAME:EXTRA_NAME - Add an additional configuration node for a DTB
	# Example:
	# FIT_CONF_MAPPINGS = "\
	# dtb-extra-conf:am335x-bonegreen:bonegreen \
	# dtb-conf:am335x-boneblack:bbblack"
	# Two DTBs (am335x-bonegreen and am335x-boneblack) result in three
	# configuration nodes: am335x-bonegreen, bonegreen, bbblack
	FIT_CONF_MAPPINGS ?= ""

	# length of address in number of <u32> cells
	# ex: 1 32bits address, 2 64bits address
	FIT_ADDRESS_CELLS ?= "1"

	# Keys used to sign individually image nodes.
	# The keys to sign image nodes must be different from those used to sign
	# configuration nodes, otherwise the "required" property, from
	# UBOOT_DTB_BINARY, will be set to "conf", because "conf" prevails on "image".
	# Then the images signature checking will not be mandatory and no error will be
	# raised in case of failure.
	# UBOOT_SIGN_IMG_KEYNAME = "dev2" # keys name in keydir (eg. "dev2.crt", "dev2.key")

	# Additional environment variables or a script which can be sourced by u-boot
	# can be packaged into the fitImage. An example is documented here:
	# https://docs.u-boot.org/en/latest/usage/cmd/source.html#fit-image
	# Machine configurations needing such a script file should include it in the
	# SRC_URI of the kernel recipe and set the FIT_UBOOT_ENV parameter.
	FIT_UBOOT_ENV ?= ""

	# Allow user to insert additional loadable images.
	# For each loadable, a number of parameters can be defined through additional
	# variable flags.
	# Example:
	# FIT_LOADABLES = "atf"
	# FIT_LOADABLE_FILENAME[atf] = "bl31.bin"
	# FIT_LOADABLE_COMPRESSSION[atf] = "none"
	# FIT_LOADABLE_DESCRIPTION[atf] = "TF-A firmware image"
	# FIT_LOADABLE_TYPE[atf] = "tfa-bl31"
	# FIT_LOADABLE_ARCH[atf] = "arm64"
	# FIT_LOADABLE_OS[atf] = "arm-trusted-firmware"
	# FIT_LOADABLE_LOADADDRESS[atf] = "0x204E0000"
	# FIT_LOADABLE_ENTRYPOINT[atf] = "0x204E0000"
	# Sensible defalts will be used for some parameters (compression, description,
	# arch, os) if the corresponding flag is not set, while others (load address
	# and entry point) will be omitted in the final FIT.
	FIT_LOADABLES ?= ""