Building for rockchip, make_fit_atf.py depends on pyelftools, a non-bundled python module that is not used elsewhere in building u-boot or the kernel.
We only use pyelftools to pull out PT_LOAD segments. ELF is very simple, so doing this manually is easy and spares users the extra dependency. In fact, a straightforward implementation shrinks make_fit_aft.py rather than adding complexity.
Andy Yan's patch
https://gitlab.denx.de/u-boot/custodians/u-boot-rockchip/commit/619f002db864...
is a prerequisite for this. (The new code does not erroneously count GNU_STACK sections and therefore without the above patch, the loadables in the conf section will always be one short, even where GNU_STACK is present.)
I have tested this script with python 2 and 3 against all bl31 elf files at
https://github.com/rockchip-linux/rkbin/tree/master/bin/rk33
as well as an rk3399 bl31.elf built locally from the master branch of
https://github.com/ARM-software/arm-trusted-firmware
to which my toolchain added the extra GNU_STACK segment.
In each case, identical *.bin files were produced compared to the pyelftools implementation, and a correct .its configuration (without off-by-one error) was emitted, with and without dtbs supplied to the script.