tree c8f1d0063338046c9a4f3a396f4913ddb03739d9
parent 9885313b9add6c04cf3059958c5ee51a4f0ac930
author Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> 1597644069 -0700
committer Tom Rini <trini@konsulko.com> 1602552637 -0400

vboot: add DTB policy for supporting multiple required conf keys

Currently FIT image must be signed by all required conf keys. This means
Verified Boot fails if there is a signature verification failure
using any required key in U-Boot DTB.

This patch introduces a new policy in DTB that can be set to any required
conf key. This means if verified boot passes with one of the required
keys, U-Boot will continue the OS hand off.

There were prior attempts to address this:
https://lists.denx.de/pipermail/u-boot/2019-April/366047.html
The above patch was failing "make tests".
https://lists.denx.de/pipermail/u-boot/2020-January/396629.html

Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com>
Reviewed-by: Simon Glass <sjg@chromium.org>