Board specific mcuboot keys

RE: Board specific mcuboot keys

AHaug — Fri, 31 Jan 2025 14:01:54 GMT

Apologies for the wait.

zephyr/share/sysbuild/CMakeLists.txt sets ${APP_DIR}

Kind regards,
Andreas

RE: Board specific mcuboot keys

Anthony Ambuehl — Thu, 23 Jan 2025 16:27:18 GMT

The sysbuild.conf has variables such as ${APP_DIR} ${BOARD} and ${BOARD_REVISION} interpretted into a string, that is what I'm referring to by sysbuild.conf expansion.

Is this interpretation of these variables a shell script processing where all environment variables are visible or is it something else where only specific variables are processed? Where can I find the cmake handling of sysbuild.conf?

RE: Board specific mcuboot keys

AHaug — Thu, 23 Jan 2025 15:18:32 GMT

Thats a valid question. If I've understood the abstraction you mean with "sysbuild.conf expansion", i.e when using sysbuild and having to add a sysbuild.conf, the answer is that some configs has to be set through sysbuild.conf, but others are still set through "regular" Kconfig. For instance enabling config_partition_manager_enabled will overwrite sysbuild configurations.

[quote user="anthony.asterisk"]Do you know where BOARD_REVISION gets defined or where sysbuild.conf gets variable substitution?[/quote]

As far as my understanding goes, you don't need a sysbuild substitution for this. It's defined here (nRF Connect SDK main) https://github.com/nrfconnect/sdk-zephyr/blob/763e6a8ab82bd1a346a9b14a4b8fc7509c8441b6/boards/Kconfig#L14

Let me know if this answers your question or if there's still something that's clarified

Kind regards,
Andreas

RE: Board specific mcuboot keys

Anthony Ambuehl — Wed, 22 Jan 2025 16:13:18 GMT

Are kconfig values available during sysbuild.conf expansion? I believe sysbuild.conf is used to determine kconfig so I am doubtful.

Do you know where BOARD_REVISION gets defined or where sysbuild.conf gets variable substitution?

RE: Board specific mcuboot keys

AHaug — Wed, 22 Jan 2025 08:43:53 GMT

Hi,

There exists nothing within downstream <NCS>/zephyr/boards/Kconfig or upstream zephyr/boards/Kconfig (or /Kconfig.v1 or Kconfig.v2) that expands to underline separation instead of period separation as far as I can see. A suggestion could be to make your own custom KConfig for this purpose that you can use within your key signing procedure, or to create a script that handles the issue with underline vs period separation when signing your firmware

Kind regards,
Andreas

RE: Board specific mcuboot keys

Anthony Ambuehl — Tue, 21 Jan 2025 16:54:41 GMT

This is working:

SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="${APP_DIR}/../../keys/${BOARD}_${BOARD_REVISION}_private_key.pem

except ${BOARD_REVISION} expands to 6.2.0 instead of 6_2_0. Is there an alternative variable name that would replace the "." with "_" ?

RE: Board specific mcuboot keys

Anthony Ambuehl — Tue, 21 Jan 2025 16:25:55 GMT

Yes the relative path works with APP_DIR. I also found that ${BOARD} works to select the board name, but I also need to select with the revision number as well.

Is there a ${REVISION} or ${QUALIFIER} or ${BOARD_REVISION}?

Is there someplace I can find what variables will be expanded in sysbuild.conf?

I want to pick some like

${APP_DIR}/../../keys/${$BOARD}_${REVISION}_private_key.pm

such as app/../../keys/plank_1_0_1_private_key.pm

RE: Board specific mcuboot keys

AHaug — Tue, 21 Jan 2025 13:47:54 GMT

Hi,

Using APP_DIR is recommended per that discussion, but if you have your keys in a directory outside of the application you should be able to specify so by adding ../APP_DIR to the relative path

Kind regards,
Andreas