Board specific mcuboot keys

[Anthony Ambuehl]

NCS 2.7

Sysbuild with mcuboot

3 board variants defined by common board with 3 revisions: [email protected],  [email protected], [email protected]

2 applications: manufacturing and customer (mfg_app and app)

I would like to setup custom image signing keys that are specific to board variants.  This will avoid accidentally loading an image on the wrong board variant.  

Also since I have multiple applications to build, I think it would make sense for the keys to be in a common directory outside of the application.

I found this discussion that recommend using APP_DIR to locate the files, but is there another variable that gets the fully qualified board name?

[AHaug]

Hi,

Using APP_DIR is recommended per that discussion, but if you have your keys in a directory outside of the application you should be able to specify so by adding ../APP_DIR to the relative path

Kind regards,
Andreas

[Anthony Ambuehl]

This is working:

SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="${APP_DIR}/../../keys/${BOARD}_${BOARD_REVISION}_private_key.pem

except ${BOARD_REVISION} expands to 6.2.0 instead of 6_2_0.   Is there an alternative variable name that would replace the "." with "_" ?

[AHaug]

Hi,

There exists nothing within downstream <NCS>/zephyr/boards/Kconfig or upstream zephyr/boards/Kconfig (or /Kconfig.v1 or Kconfig.v2) that expands to underline separation instead of period separation as far as I can see. A suggestion could be to make your own custom KConfig for this purpose that you can use within your key signing procedure, or to create a script that handles the issue with underline vs period separation when signing your firmware

Kind regards,
Andreas

[Anthony Ambuehl]

Are kconfig values available during sysbuild.conf expansion?  I believe sysbuild.conf is used to determine kconfig so I am doubtful.

Do you know where BOARD_REVISION gets defined or where sysbuild.conf gets variable substitution?

[AHaug]

Thats a valid question. If I've understood the abstraction you mean with "sysbuild.conf expansion", i.e when using sysbuild and having to add a sysbuild.conf, the answer is that some configs has to be set through sysbuild.conf, but others are still set through "regular" Kconfig. For instance enabling config_partition_manager_enabled will overwrite sysbuild configurations.

Anthony Ambuehl said:

Do you know where BOARD_REVISION gets defined or where sysbuild.conf gets variable substitution?

As far as my understanding goes, you don't need a sysbuild substitution for this. It's defined here (nRF Connect SDK main) https://github.com/nrfconnect/sdk-zephyr/blob/763e6a8ab82bd1a346a9b14a4b8fc7509c8441b6/boards/Kconfig#L14

Let me know if this answers your question or if there's still something that's clarified

Kind regards,
Andreas

[Anthony Ambuehl]

The sysbuild.conf has variables such as ${APP_DIR}  ${BOARD} and ${BOARD_REVISION} interpretted into a string, that is what I'm referring to by sysbuild.conf expansion.

Is this interpretation of these variables a shell script processing where all environment variables are visible or is it something else where only specific variables are processed?  Where can I find the cmake handling of sysbuild.conf?

[AHaug]

Hi 

Apologies for the wait.

zephyr/share/sysbuild/CMakeLists.txt sets ${APP_DIR}

Kind regards,
Andreas