How to create a MCUBoot image and an application image without modifying the SDK?

[Giannis Anastasopoulos]

Dear All,

I am trying to create  an application that uses the MCUBoot, so that later I can perform a FOTA operation.

From what I know so far there are some keys in the SDK that the MCUBoot prj.conf is pointing to and uses those keys to create the signed bin files.

So if someone wants to use a custom key, he could potentially replace thekey in the SDK and then it would work. But this would require to modify the SDK, which I would like to avoid completely.

While I was trying to figure out this issue, I came across this link that suggests that someone can first compile the application, including the MCUBoot and then sign it with a custom key, that felt right the exact thing I am looking for. But this unfortunately didn't work.

What I did is this:

west build -p auto -b nrf9160dk_nrf9160ns
west sign -t imgtool -- --key private-key.pem --header-size 32 --pad

And what I got is this:

Error: Header padding was not requested and image does not start with zeros
FATAL ERROR: command exited with status 2: 'C:\Python37\Scripts\imgtool.EXE' sign --version 0.0.0+0 --align 4 --header-size 0 --slot-size 196608 --key private-key.pem --header-size 32 --pad C:/Users/SODAQ/Desktop/GIT_Projects/bayer_tag/build/zephyr/zephyr.bin 'C:\Users\SODAQ\Desktop\GIT_Projects\bayer_tag\build\zephyr\zephyr.signed.bin'

From what I can understand the

CONFIG_BOOTLADER_MCUBOOT=y

effectively compiles and adds the bootloader in the project, but the bootloader uses the default key of the SDK and this very undesired.

So is there any way possible to effectively sign the .hex file again with the custom private key and then be able to use the .bin file with the custom private key, without modifying the SDK at all?

Also, I am not sure what is the role of the SPM in this process.

I am using the NCS SDK v1.3.0

Thank you very much for your assistance

[Heidi]

Hi!

I just wanted to let you know that I'm working on your case and I'll get back to you with an answer on Monday. Have a good weekend!

Best regards,

Heidi

[Vojislav]

Hi,

I am also interested in this. So is it possible to add my .pem file into my application folder and configure the build system to use it for building the MCUboot and signing the application instead of the default one which is located in MCUboot repo.

Best regards,
Vojislav

[Vojislav]

Heidi have you managed to find the solution to this issue?

[Heidi]

Hi! It looks like there are a few ways to do it.

You could set CONFIG_MCUBOOT_SIGNATURE_KEY_FILE to the full path of the .pem file you want to use. I believe you will need to change CONFIG_BOOT_SIGNATURE_KEY_FILE in your MCUboot. config as well. 

Or create an mcuboot.conf file in your application with these configurations and append them to the MCUboot configurations by adding the following in the CMakeLists.txt file in the application you are running. Make sure to place it right after the cmake_minimum_required line.

cmake_minimum_required(VERSION 3.13.1)
 
if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot.conf")
    list(APPEND mcuboot_OVERLAY_CONFIG
      "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot.conf"
      )
endif()

Let me know if there's anything else.

Best regards,

Heidi

[Heidi]

Hi Giannis Anastasopoulos!

Yes, you should be able to set the configurations I mentioned below to point to the file containing the key you want to use and MCUboot will use that instead.

 

Also, I am not sure what is the role of the SPM in this process.

 The SPM is for when you're running an application on the non-secure domain of the chip. This application set sup the device with trusted execution so that it can run your application on the non-secure domain. 

Let me know if you have any more questions!

Best regards,

Heidi