The difference between prj.conf and prj_release.conf

[SunHuang]

Since I encountered some issues, I would like to confirm the differences between these two files once again.

Apart from debug messages, can prj.conf be used for the final product release?

Are there any other important considerations, such as BIN file encryption or similar matters?

[Sigurd Hellesvik]

Hi,

Since I encountered some issues, I would like to confirm the differences between these two files once again.

prj.conf is used by default. prj_release.conf is used if you use the FILE_SUFFIX "release". See Custom configurations.

Apart from debug messages, can prj.conf be used for the final product release?

prj_release.conf is just a way to show that your own project can use a separate file for release.

Are there any other important considerations, such as BIN file encryption or similar matters?

There are a lot of considerations, but most depend on your project requirements, so I can not give one solution that covers all scenarios.

Here are a couple of things that I think are a good idea to do:

1. Remember to add DFU so you can update your product in the field!

2. Properly test the device before releasing it!

3. Back up the build directory from your release build, sometimes you need this later.

4. Enable APPROTECT.

Regards,
Sigurd Hellesvik

[SunHuang]

Here are the things I originally wanted to confirm:

1. Can prj.conf be used for mass production?
2. Will it be vulnerable to malicious access or modification?

The APPROTECT feature you suggested seems to address the second issue. How can I enable APPROTECT?

[Sigurd Hellesvik]

SunHuang said:

Can prj.conf be used for mass production?

While the answer here is thecnically "yes". This is not a relevant question to ask.
It is like asking "Can C be used for production?".
Kconfig(which uses prj.conf) just a concept we use to configure projects.

SunHuang said:

Will it be vulnerable to malicious access or modification?

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/security/ap_protect.html

[SunHuang]

Hi,

I have already added the following three configurations to prj.conf. However, nRF Connect can still read the data. Did I miss any steps?

CONFIG_NRF_SECURE_APPROTECT_LOCK=y
CONFIG_NRF_SECURE_APPROTECT_USER_HANDLING=y
CONFIG_NRF_SECURE_APPROTECT_USE_UICR=y

[Sigurd Hellesvik]

SunHuang said:

Did I miss any steps?

Yes. You are to only set one of the configurations.

[SunHuang]

Hi,

I previously tried using only CONFIG_NRF_SECURE_APPROTECT_LOCK, but it did not disable the Flash read function. That’s why I attempted to enable all three configurations.

By the way, the SDK version I’m using is 2.9.0.

[Sigurd Hellesvik]

Try SB_CONFIG_APPROTECT_LOCK=y in sysbuild.conf