NCS 3.4.0 - Thingy91X - build without SECURE_BOOT_APPCORE fails to flash

[Achim Kraus]

NCS 3.4.0 - Thingy91X

If I configure the sysbuild with sysbuild.conf

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_SECURE_BOOT_APPCORE=n

it builds, but on "west flash" I get

FATAL ERROR: ???/ncs/v3.4.0/app/build/app/../signed_by_mcuboot_and_b0_app.hex does not exist. Try enabling CONFIG_BUILD_OUTPUT_HEX.

but with SB_CONFIG_SECURE_BOOT_APPCORE=n that's intended to not have that file.

I tried to analyze the issue and found in Kconfig.defconfig.nrf9151:

config SECURE_BOOT
    default y

If I change that to 'n' it work to flash and the app runs well.

Unfortunately, it's not possible to overwrite that in sysbuild.conf with

SB_CONFIG_SECURE_BOOT=n

because that results in 

error: SECURE_BOOT (defined at ???/ncs/v3.4.0/nrf/modules/../sysbuild/Kconfig.secureboot:7)
is assigned in a configuration file, but is not directly user-configurable (has no prompt). It gets
its value indirectly from other symbols

So:

why is 

config SECURE_BOOT
    default y

instead of 

config SECURE_BOOT_APPCORE
    default y

?

[Achim Kraus]

The SECURE_BOOT could be overwritten in the project's Kconfig with:

config SECURE_BOOT
    default n

There are then two points left for a simple mucboot setup:

The dts uses "nordic,pm-ext-flash = &flash_ext;", which may be required to be deleted with "/delete property/", if the external flash is not intended to be used. 

The current implementation of "subsys/dfu/img_util/flash_img.c" fails, if SECURE_BOOT is not selected. That requires an fix.

With all three point's I'm able to use a simple mcuboot setup.