From d49d46ee0d5401574f453fa1c6ed594afc0ea5f1 Mon Sep 17 00:00:00 2001
From: bunnie <bunnie@kosagi.com>
Date: Fri, 5 Jan 2024 16:14:09 +0800
Subject: [PATCH] pre-hash sign the kernel image; normal signing for loader
 image

The loader image uses the original signing method, because changing
that would require us to modify the gateware ROM, which is a huge
pain in the ass, and doesn't buy us anything.

Thus only the kernel signing uses the pre-hash method.
---
 tools/src/bin/sign-image.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/src/bin/sign-image.rs b/tools/src/bin/sign-image.rs
index 09e0329eb..852fd2f62 100644
--- a/tools/src/bin/sign-image.rs
+++ b/tools/src/bin/sign-image.rs
@@ -108,6 +108,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             &loader_pkey,
             matches.is_present("defile"),
             &minver,
+            false
         )?;
     }
 
@@ -131,6 +132,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             &kernel_pkey,
             matches.is_present("defile"),
             &minver,
+            true,
         )?;
     }
     Ok(())