[PATCH v2 17/17] Documentation: migration-2025.11.0: List changes to CONFIG_CRYPTO_PUBLIC_KEYS

[Ahmad Fatoum]

On 11/3/25 11:16 AM, Sascha Hauer wrote:
> On Tue, Oct 28, 2025 at 07:03:22PM +0100, Jonas Rebmann wrote:
>> As part of the introduction of TLV signature in public key keyrings,
>> there is a new interpreter for CONFIG_CRYPTO_PUBLIC_KEYS in
>> scripts/keytoc.c. All users should update to the new syntax and are
>> presented with a warning. Users with invalid characters in the legacy
>> syntax must change the fit-hint and will be presented with an error.
>>
>> Signed-off-by: Jonas Rebmann <jre at pengutronix.de>
>> ---
>>  Documentation/migration-guides/migration-2025.11.0.rst | 15 +++++++++++++++
>>  1 file changed, 15 insertions(+)
>>
>> diff --git a/Documentation/migration-guides/migration-2025.11.0.rst b/Documentation/migration-guides/migration-2025.11.0.rst
>> index a9c7abb66e..bd7fcf8126 100644
>> --- a/Documentation/migration-guides/migration-2025.11.0.rst
>> +++ b/Documentation/migration-guides/migration-2025.11.0.rst
> 
> migration-2025.12.0.rst please.

Should we rethink the scheme to avoid this in future?

Two suggestions come to mind:

- We add migration-next.rst and migration-master.rst files, where stuff
can be added and then they are renamed before release:

migration-master.rst -> migration-${version}.rst
migration-next.rst -> migration-master.rst
<empty file> -> migration-next.rst

- We concatenate all migration guides into a single file and before
release, a new heading is added?

Cheers,
Ahmad

> 
> Sascha
> 
>> @@ -1,6 +1,21 @@
>>  Release v2025.11.0
>>  ==================
>>  
>> +Configuration options
>> +---------------------
>> +
>> +* The syntax of ``CONFIG_CRYPTO_PUBLIC_KEYS`` was updated with the introduction
>> +  of the keyring feature. Previously, keys selected via
>> +  ``CONFIG_CRYPTO_PUBLIC_KEYS`` were only used for fitimage verification. Now,
>> +  fitimage verification uses the "fit" keyring. "fit" will be selected as the
>> +  default keyring for transition but a warning will be emitted when no keyring
>> +  is explicitly provided. Existing users should update their keyspec for
>> +  fitimage public keys to ``keyring=fit[,fit-hint=<fit_hint>]:<crt>``
>> +* The fit-hints in ``CONFIG_CRYPTO_PUBLIC_KEYS`` are now limited to identifiers
>> +  matching the regular expression ``[a-zA-Z][a-zA-Z0-9_-]*``. Public keys with
>> +  a ``fit-hint`` not conforming to this results in an error, affected key-hints
>> +  must be changed. Please reach out to the mailing list if this causes issues.
>> +
>>  i.MX GPIOs
>>  ----------
>>  
>>
>> -- 
>> 2.51.2.535.g419c72cb8a
>>
>>
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |