12:25 <Kwiboo> qschulz: if you have time, please take a quick look at https://source.denx.de/u-boot/contributors/kwiboo/u-boot/-/commits/binman-v5, let me know if you want me to adjust or drop any commits before I send v5 out later tonight :-)

12:37 <Daanct12> just improved my vop2 patches for u-boot

12:37 <Daanct12> now it'll setup vop depends on which win_id is used

12:37 <qschulz> Kwiboo: I'm not convinced by Simon's justification for the skip-at-start part, but I haven't taken the time to re-read what he said

12:38 <Daanct12> i wanted to support cluster but i can't get it to work.. yet, perhaps i should do itl ater :]

12:38 <qschulz> I think we should focus on the templating part and get that merged, the skip-at-start + fit,fdtmap can come later?

12:38 <qschulz> Kwiboo: I'll try to do this signing too to check the hash algo

12:39 <qschulz> I "need" to force a specific salt length for a downstream tree, and would like the knobs to be upstreamed so i'll be forced to do signatures at some point :)

12:43 <Kwiboo> qschulz: I can skip the last three patches (crc32, skip-at-start and fdtmap) for v5, they are not necessary right now, crc32 is more related to a possible future series to convert rk3228 to use FIT, and skip-at-start + fdtmap is more related to VBE

13:09 <CounterPillow> Daanct12: nice!

13:10 <Daanct12> CounterPillow: BTW i think you're someone asking for that, do you need my CC?

13:11 <CounterPillow> Daanct12: asking for what, vop2 in u-boot? I was interested in that when I looked into the pinetab2 briefly, currently I'm busy with paid work (RK3576 upstreaming) where video output in u-boot isn't a priority right now. You can always Cc the patches to either frattaroli.nicolas@gmail.com or nicolas.frattaroli@collabora.com and I'll take a look at them when I have time

13:12 <Daanct12> yup, vop2 in u-boot

13:12 <Daanct12> will do so

16:56 <qschulz> Kwiboo: I experimentally checked and it seems whatever hashing algorithm is put in the DT will be used for verifying image nodes when signing the conf node

17:06 <qschulz> and if I remove the hash nodes, then binman fails to build the image

17:07 <qschulz> so the crc32 hash, not great :/

17:08 <qschulz> but at the same time, it seems I needed to modify the existing devicetree to be able to compile something that verifies signatures and generates hashes and signatures properly

17:08 <qschulz> so I guess "issue for future me to deal with insecure hashes"?

17:39 <Kwiboo> qschulz: hehe, possible an issue for the future :-), also FIT imply SHA256 that imply SPL_SHA256, so crc32 would practically only be aviliable as a fallback hash checksum algo if a user explicitly disable SPL_SHA256

17:40 <Kwiboo> I am going to see what hash algo u-boot.img get by default, if any