aws-fota program can't be built

[Yusuke]

I'm trying to build aws-fota program following this instruction, but get an error
https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/nrf9160/aws_fota/README.html#building-and-running

1> Archiving ‘libkernel.a’
Building ‘zephyr/zephyr_prebuilt.elf’ from solution ‘build’ in configuration ‘Common’
1> Compiling ‘empty_file.c’
1> Linking ‘zephyr_prebuilt.elf’
1> Memory region         Used Size  Region Size  %age Used
1>            FLASH:      131476 B     380416 B     34.56%
1>             SRAM:       43840 B       128 KB     33.45%
1>         IDT_LIST:         120 B         2 KB      5.86%
Building ‘zephyr/linker_pass_final.cmd’ from solution ‘build’ in configuration ‘Common’
1> Combining ‘zephyr/linker_pass_final.cmd’
Building ‘zephyr/CMakeFiles/linker_pass_final_script_target’ from solution ‘build’ in configuration ‘Common’
Building ‘zephyr/linker_pass_final_script_target’ from solution ‘build’ in configuration ‘Common’
Building ‘zephyr/isr_tables.c’ from solution ‘build’ in configuration ‘Common’
1> Combining ‘zephyr/isr_tables.c’
Building ‘cmake_object_order_depends_target_zephyr_final’ from solution ‘build’ in configuration ‘Common’
Building ‘zephyr/zephyr.elf’ from solution ‘build’ in configuration ‘Common’
1> Compiling ‘empty_file.c’
2> Compiling ‘isr_tables.c’
1> Linking ‘zephyr.elf’
1> Post-link command 
Building ‘zephyr/mcuboot_primary_app.hex’ from solution ‘build’ in configuration ‘Common’
1> Combining ‘zephyr/mcuboot_primary_app.hex’
1> Merged /Users/fukuharayuusuke/nRF9160/ncs/nrf/samples/nrf9160/aws_fota_custom/build_nrf9160_pca10090ns/zephyr/zephyr.hex
1> Merged /Users/fukuharayuusuke/nRF9160/ncs/nrf/samples/nrf9160/aws_fota_custom/build_nrf9160_pca10090ns/spm/zephyr/zephyr.hex
Building ‘CMakeFiles/mcuboot_primary_app_hex’ from solution ‘build’ in configuration ‘Common’
Building ‘mcuboot_primary_app_hex’ from solution ‘build’ in configuration ‘Common’
Building ‘zephyr/signed.hex’ from solution ‘build’ in configuration ‘Common’
1> Combining ‘zephyr/signed.hex’
1> Traceback (most recent call last):
1>   File "/Users/fukuharayuusuke/nRF9160/ncs/mcuboot/zephyr/../scripts/imgtool.py", line 17, in <module>
1>     from imgtool import main
1>   File "/Users/fukuharayuusuke/nRF9160/ncs/mcuboot/scripts/imgtool/main.py", line 21, in <module>
1>     import imgtool.keys as keys
1>   File "/Users/fukuharayuusuke/nRF9160/ncs/mcuboot/scripts/imgtool/keys/__init__.py", line 19, in <module>
1>     from cryptography.hazmat.backends import default_backend
1> ModuleNotFoundError: No module named 'cryptography'
Build failed

it seems mcuboot is related so I reinstalled it.

pip3 uninstall -r nrf/scripts/requirements.txt
pip3 install --user -r nrf/scripts/requirements.txt

However, still I get the error. Any help to solve this?

- nRF9160 DK 0.8.5
- nrf tag: v1.0.0
- modem fw: v1.0.1
- mqtt_simple + TLS program can be built and works fine.

And I have another question. This is described in the above web page.

When these steps are done, deselect CONFIG_USE_PROVISIONED_CERTIFICATES in menuconfig. This will write your new certificates to the secure tag sec_tag_t defined in menuconfig CONFIG_CLOUD_CERT_SEC_TAG into the modem.

After deselecting, don' you have to select it again? 

[Yusuke]

I don't know what causes the issue, but it seems to be fixed.

I tried many approaches and don't exactly remember what I tried.

It works with this condition

SES: 4.18
tool > options > nRF Connect > Python Executable: /Users/<username>/.pyenv/shims/python

[Yusuke]

Hi, Vidar

I updated nrf tag and modem fw to 1.1.0

aws_fota programs works out!

However, this warning shows up when the program runs.

************************* WARNING *************************
provision_certificates called do not use this in production!
This will store the certificates in readable flash and leave
them exposed on modem_traces. Only use this once for
provisioning certificates for development to reduce flash tear.
************************* WARNING *************************

What does this mea?

Does this mean I should add a line of "CONFIG_PROVISION_CERTIFICATES=y" to prj.conf only in production process, and I shouldn't add this to a firmware which works on client side?

Also, what should I do if the fota process fails? Is it possible to retry fota process a few minutes after the first try fails?

[Vidar Berg]

Hi,

Excellent! The warning is against including certificates in the final application binary. Provisioning to the modem is a one-time operation, and there are other ways to do provisioning, for instance through the LTE link monitor app: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/nrf9160/aws_fota/README.html#updating-the-certificates.