Inconsistent settings CRC with nrfutil settings generate command

[manu]

Hello,

I am encountering an issue with the nrfutil settings generate command. Each time the command is executed with the exact same parameters, the resulting settings.hex file has a different CRC value. This is problematic as it affects reproducibility of builds.

In particular, I have noticed that the Boot Validation CRC seems to be the value that changes each time. Could you clarify the purpose and meaning of the Boot Validation CRC, and why it might differ between runs with identical input?

[Vidar Berg]

Hello, 

The CRC should not change if you use the same input hex file each time. Could you please run 'nrfutil settings display settings.hex' and post the output here?

Thanks,

Vidar

[manu]

Hi,

Thanks for the response.

I create the settings file twice with:

nrfutil settings generate --family NRF52 --application myhex.hex --application-version-string "0.0.0" --app-boot-validation "VALIDATE_ECDSA_P256_SHA256" --key-file ecckey.txt --bootloader-version 0 --bl-settings-version 2 settings.hex

Then with settings display first time:

> nrfutil settings display settings.hex

Bootloader DFU Settings:
* File:                     settings.hex
* Family:                   nRF52
* Start Address:            0x0007E000
* CRC:                      0x8E686380
* Settings Version:         0x00000002 (2)
* App Version:              0x00000000 (0)
* Bootloader Version:       0x00000000 (0)
* Bank Layout:              0x00000000
* Current Bank:             0x00000000
* Application Size:         0x00041B14 (269076 bytes)
* Application CRC:          0xB1F669C0
* Bank0 Bank Code:          0x00000001
* Softdevice Size:          0x00000000 (0 bytes)
* Boot Validation CRC:      0xA22B4410
* SD Boot Validation Type:  0x00000000 (0)
* App Boot Validation Type: 0x00000003 (3)

Second time:

Bootloader DFU Settings:
* File:                     settings.hex
* Family:                   nRF52
* Start Address:            0x0007E000
* CRC:                      0x8E686380
* Settings Version:         0x00000002 (2)
* App Version:              0x00000000 (0)
* Bootloader Version:       0x00000000 (0)
* Bank Layout:              0x00000000
* Current Bank:             0x00000000
* Application Size:         0x00041B14 (269076 bytes)
* Application CRC:          0xB1F669C0
* Bank0 Bank Code:          0x00000001
* Softdevice Size:          0x00000000 (0 bytes)
* Boot Validation CRC:      0x732C0C40
* SD Boot Validation Type:  0x00000000 (0)
* App Boot Validation Type: 0x00000003 (3)

nruftil version is 7.7.0. Each time Boot Validation CRC changes. Each time, settings.hex file ends up with a new checksum so everytimewhen we combine identical bootloader and application binaries using mergehex the end result has a different checksum compared to previous run.

[Vidar Berg]

Hi,

Thanks. I see you are using signature validation (ECDSA), not CRC. The signature will change with every iteration because it is computed using a random nonce. If you want the boot validation to remain the same you need to use HASH or CRC validation.

Best regards,

Vidar

[manu]

Thanks for the quick response and explanation! This clears things for me.