nrfcredstore - Failed to list credentials

[zpm1066]

Environment: nRF Connect SDK v3.4.0 on macOS Golden Gate 27.0 and Sequoia 15.8

Device: nRF9151-DK

Problem occurred during build and testing of AWS connectivity to AWS IoT Core using the sample AWS IOT (/opt/nordic/ncs/v3.4.0/nrf/samples/net/aws_iot).

I was able to successfully setup & configure AWS IoT Core and build the aws_iot sample. This runs successfully and I'm able to successfully subscribe & publish between AWS IoT Shadow Service and the nRF9151-DK.

However, nrfcredstore fails to list credentials, with the following error.

nebula@nebula nrf9151dk_ns % nrfcredstore /dev/tty.usbmodem0010512176251 list             
Traceback (most recent call last):
  File "/opt/nordic/ncs/toolchains/ccc010f809/bin/nrfcredstore", line 6, in <module>
    sys.exit(run())
             ^^^^^
  File "/opt/nordic/ncs/toolchains/ccc010f809/lib/python3.12/site-packages/nrfcredstore/cli.py", line 171, in run
    main(args, CredStore(cred_if))
  File "/opt/nordic/ncs/toolchains/ccc010f809/lib/python3.12/site-packages/nrfcredstore/cli.py", line 146, in main
    exec_cmd(args, credstore)
  File "/opt/nordic/ncs/toolchains/ccc010f809/lib/python3.12/site-packages/nrfcredstore/cli.py", line 95, in exec_cmd
    creds = credstore.list(args.tag, ct)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/nordic/ncs/toolchains/ccc010f809/lib/python3.12/site-packages/nrfcredstore/credstore.py", line 63, in list
    raise RuntimeError("Failed to list credentials")
RuntimeError: Failed to list credentials

Prior to adding the AWS certificates & client key, nrfcredstore was successfully able to list the credentials.

I'm able to successfully list credentials using the "--tag" option in the nrfcredstore command. So, the credentials are correctly stored. 

I've also verified that all the other certificates & keys are stored correctly.

For example,

nebula@nebula nrf9151dk_ns % nrfcredstore /dev/tty.usbmodem0010512176251 list --tag 4294967292

Secure tag   Key type           SHA                                                             
4294967292   NORDIC_PUB_KEY     672E2F05962B4EFBFA8801255D87E0E0418F2DDF4DDAEFC59E9B4162F512CB63

In addition, if the credentials are listed using the AT%CMNG=1, only some of the credentials get displayed properly, the rest get truncated.

This appears to be bug in nrfcredstore. Please review. Thank you.

KInd Regards

[Syed Maysum Abbas Zaidi]

Hi,

You're right about the version and I think we don't need to check it further.
I was just looking at your screenshot  and I think mosh:~$ prompt means you have Modem Shell flashed, and MoSh prints everything through a 1024 byte buffer (CONFIG_MOSH_PRINT_BUFFER_SIZE). That's the red "Cutting too long string" message. Your credential list is around 1100 bytes, so the tail gets cut. I think that's an issue, and it's why it worked before the AWS certs and still works per-tag.

Can you try rebuilding with increasing this config to 4096 in your prj.conf.

[zpm1066]

Hi Syed,

Thank you. This doesn't address the bug that is the "nrfcredstore".  

I'm running the AWS IOT sample targeted for nrf9151dk, and invoking nrfcredstore from a "nRF Connect" session from within nRF Connect SDK for VS Code.

So, we still need to address the nrfcredstore bug that is in the current NCS 3.4.x. 

Separately, I re-built the "Modem Shell" and increased CONFIG_MOSH_PRINT_BUFFER_SIZE as per your suggestion. This does now correctly display the credentials. Thank you.



Could you please investigate further the "nrfcredstore" bug? It is in the current NCS 3.4.x.

Also, previously you suggested to update nrfcredstore via  "pip show nrfcredstore" to determine the version, How do I start a Python virtual environment session for NCS and execute the command above?

Kind Regards,
Ravi

[Syed Maysum Abbas Zaidi]

Hi,

I checked the AWS IoT build. The cause is the same kind of limit, in different code. In that build the AT Host shares uart0 with the uart console, and because logging is enabled, AT responses are sent out through Zephyr's logging subsystem. That buffer defaults to 1024 bytes. Your credential list is about 1100 bytes, so the message is dropped. nrfcredstore waits for that OK, never receives it, and reports "Failed to list credentials". Per tag listing works because those responses are short enough to fit.

You may try to add CONFIG_LOG_BUFFER_SIZE=4096 to your AWS IoT prj.conf and rebuild.

On the Python question, the NCS toolchain is a self contained Python install. You can just run (but your version is current, so there's nothing to update)

/opt/nordic/ncs/toolchains/ccc010f809/bin/python3 -m pip show nrfcredstore

But Yes in short, I think the issue is AWS IoT sample enables an AT Host and AT Host routes responses through Zephyr's logging subsystem which has a limit of 1024 Bytes. So I will raise this internally.

Let me know how the rebuild goes. Thanks

[zpm1066]

Hi Syed,

Thank you for the detailed explanation and the resolution for increasing the default log buffer size. 

The AT command to list the nrf9151dk stored credentials now works as expected.

Thank you for raising the NCS "nrfcredstore" issue internally. I'll go ahead and close the ticket.

Once again, your assistance on this issue is very much appreciated.


Kind Regards,
Ravi