[PATCH v4 8/8] crypto: keytoc: Deprecate fit-hint from env variable

[Jonas Rebmann]

Specification of fit-hints as env variable was broken since identifiers
where forbidden to start with underscores in 2025.12. As the fit-hint
feature is considered legacy, officially deprecate this way of
specifying fit-hints.

Signed-off-by: Jonas Rebmann <jre at pengutronix.de>
---
 Documentation/migration-guides/migration-master.rst | 4 ++++
 crypto/Kconfig                                      | 7 +++----
 scripts/keytoc.c                                    | 7 +++----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst
index 9d1756bdc4..58efc225cb 100644
--- a/Documentation/migration-guides/migration-master.rst
+++ b/Documentation/migration-guides/migration-master.rst
@@ -17,6 +17,10 @@ While the interpretation of environment variables specifying hint or URI remains
 
   CONFIG_CRYPTO_PUBLIC_KEYS="keyring=kr:__ENV__B"
 
+Fit hints can no longer be specified by environment variables using the __ENV__
+syntax. This functionality was broken since the last change to the keyspec
+syntax in 2025.12.
+
 ARM i.MX HAB
 ------------
 
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 528e9a0d22..0a6b5758b7 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -153,7 +153,7 @@ config CRYPTO_PUBLIC_KEYS
 
 	  Placeholders such as __ENV__VAR_NAME can be used to look up the
 	  corresponding value in the environment variable VAR_NAME for public
-	  key paths/URIs as well as key name hints.
+	  key paths/URIs.
 
 	  Examples specified directly:
 
@@ -162,11 +162,10 @@ config CRYPTO_PUBLIC_KEYS
 	  - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=myhint:pkcs11:object=foo keyring=fit:/foobar/baz.der"
 	  - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=myhint:pkcs11:object=foo keyring=fit,fit-hint=myotherhint:/foobar/baz.der"
 
-	  Example specified indirectly by two environment variables:
+	  Example specifying the path by environment variable:
 
-	  - myhint="myhint"
 	  - myname="pkcs11:object=foo" (.der could be used too)
-	  - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=__ENV__myhint:__ENV__myname"
+	  - CONFIG_CRYPTO_PUBLIC_KEYS="keyring=fit,fit-hint=hint:__ENV__myname"
 
 	  Example specified indirectly by a single environment variable:
 
diff --git a/scripts/keytoc.c b/scripts/keytoc.c
index c4491fbe81..49cb10f3f5 100644
--- a/scripts/keytoc.c
+++ b/scripts/keytoc.c
@@ -720,8 +720,8 @@ static bool is_identifier(char **s)
 {
 	char *p = *s;
 
-	/* [a-zA-Z_] */
-	if (!(isalpha(*p) || *p == '_'))
+	/* [a-zA-Z] */
+	if (!isalpha(*p))
 		return false;
 	p++;
 
@@ -913,8 +913,7 @@ int main(int argc, char *argv[])
 			exit(1);
 		}
 
-		/* resolve __ENV__ for name_hint and path */
-		info->name_hint = try_resolve_env(info->name_hint);
+		/* resolve __ENV__ for the key path */
 		info->path = try_resolve_env(info->path);
 
 		if (asprintf(&info->name_c, "key_%i", keys_idx + 1) < 0)

-- 
2.53.0.308.g50d063e335