Signing of ncs-serial-modem firmware

[Konstantin Klitenik]

Currently, the ncs-serial-modem releases seem to be signed with the default signing key. Does Nordic plan to sign releases with a private Nordic key so we can be ensure non-Nordic-built images cannot be OTA'd to the device?

Right now, our plan is to have a github action that would pull ncs-serial-modem and make a build with our own key. Ideally, we wouldn't have to do that and could use Nordic-signed builds. I believe something like this was discussed for nrf91m1 builds.

Thanks,

Konstantin

[Samruddhi Jadhav]

Hello,

I am looking into this and will have to discuss it internally with the team. I will get back to you soon with an update by this week once I receive any further information. 

Best Regards,

Samruddhi

[Samruddhi Jadhav]

Hello, 

Just an update on this from the team. We have just made this signing for the first time officially today after creating v2.0.0 release. The signing is done outside the GitHub actions that have generated the current release artifacts. We will share the resulting binaries in GitHub also as:  serial_modem_v2.0.0_nrf91m1.zip in the next few weeks. 

This will be the exact same Serial Modem feature content as: serial_modem_v2.0.0_nrf9151dk_nrf91m1.zip with the exception of the signing. The latter is signed with NCS developer key and the former is signed with Nordic's private key. 

nRF91M1 is a product that will get serial_modem_v2.0.0_nrf91m1.hex binary and mfw_nrf91x1_2.0.4: nRF91M1 - nordicsemi.com

Please let us know if you have any further questions. 

Best Regards,

Samruddhi

[Konstantin Klitenik]

Thank you. 

Are there any plans to ship NTN modem fw with nrf91m1?

[Konstantin Klitenik]

If we wanted our mcuboot to allow both nordic private signed and our own signed, is the public portion of the Nordic private key available in the repo so we could include both in our mcuboot?

[Samruddhi Jadhav]

Hi,

Konstantin Klitenik said:

Are there any plans to ship NTN modem fw with nrf91m1?

From our production, nrF91M1 will ship with mfw_nrf91x1_2.0.4. You can update it to NTN FW as given here: Introduction — nRF91M1 AT Commands 1.0 documentation

Konstantin Klitenik said:

If we wanted our mcuboot to allow both nordic private signed and our own signed, is the public portion of the Nordic private key available in the repo so we could include both in our mcuboot?

This is currently not available. 

Best Regards,

Samruddhi