sysbuild + mcuboot and board specific signature keys

[Andreas Auer]

Hello.

I'm currently migrating our existing application code to the NCS 3.1.0 SDK. As far as I have recognized, with sysbuild the child image build has been replaced. We are building our source code together with mcuboot. I managed to add mcuboot by adding

SB_CONFIG_BOOTLOADER_MCUBOOT=y

it to sysbuild.conf file.

We are building the image for different boards and we want to sign the update image for mcuboot with different keys. The documentation tells us to add a 

sysbuild/mcuboot/boards/

directory with different board configurations. I thought it should be possible to overwrite the key file for each board with different 

CONFIG_BOOT_SIGNATURE_KEY_FILE="<pem file>"

But this config is not taken into account. Always the dev keys are used for signing. Only way I managed to use our own key is to add the 

SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="<pem file>"

to the "sysbuild.conf" file. But in this case, I have the same key for every board.

I also found another thread ( RE: Migrating child/parent image to sysbuild - MCUBoot with different keys for different board ) discussing this and I'm wondering if there is already a solution/fix for this. The workaround in this thread isn't really satisfying.

Thanks for your help and best regards,
Andreas

[Hung Bui]

Hi Andreas, 
For setting up custom key, I would suggest to take a look at our tutorial here: https://academy.nordicsemi.com/courses/nrf-connect-sdk-intermediate/lessons/lesson-9-bootloaders-and-dfu-fota/topic/exercise-2-dfu-over-usb-adding-external-flash/

Regarding your request, for more complex applications, we use different configuration folder for each board. You can take a look at our nRF_Desktop application: 
https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/applications/nrf_desktop/README.html

\nrf\applications\nrf_desktop

You can find that the configurations including the sysbuild.conf is located in the configuration\{board}\ folder. So each board would has its own sysbuild.conf. 

To do that we have this line in CMakeLists.txt :
set(APPLICATION_CONFIG_DIR "${CMAKE_CURRENT_LIST_DIR}/configuration/\${NORMALIZED_BOARD_TARGET}")

and sysbuild\CMakeLists.txt:

set(SB_APPLICATION_CONFIG_DIR "${CMAKE_CURRENT_LIST_DIR}/../configuration/\${NORMALIZED_BOARD_TARGET}")