How to sign NCS firmware in order to be compatible with Zephyr bootloader

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Jorcis — Tue, 07 Jun 2022 07:51:05 GMT

Interesting Einar, thanks!

Finally I managed to get bootloader to work.

NCS v2.4.99-ncs2, comes with mcuboot integration and it generates the bootloader when building. The problem was that I was using an external bootloader generated by other zephyr project.

Thanks very much for you kind support, you can close the ticket.

Best regards,

Jordi.

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Einar Thorsrud — Thu, 02 Jun 2022 13:41:50 GMT

Hi Jordi,

The various fields of the boot_swap_state and the meaning of them is explained in bootutil_public.h. Here the secondary image is bad (corrupt) for some reason.

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Jorcis — Wed, 01 Jun 2022 13:07:44 GMT

Hi Einar, I realized slot0 and slot1 sizes in device tree where not equal, so that I have equalized there in the following manner:

&flash0 {
	partitions {
		compatible = "fixed-partitions";
		#address-cells = <1>;
		#size-cells = <1>;

		boot_partition: partition@0 {
			label = "mcuboot";
			reg = <0x000000000 0x0000C000>;
		};

		slot0_partition: partition@c000 {
			label = "image-0";
			reg = <0x0000C000 0x00066000>;
		};

		slot1_partition: partition@72000 {
			label = "image-1";
			reg = <0x00072000 0x00066000>;
		};

		scratch_partition: partition@d8000 {
			label = "image-scratch";
			reg = <0x000d8000 0x0001e000>;
		};

		settings_partition: partition@f6000 {
			label = "settings";
			reg = <0x000f6000 0x00001000>;
		};

		storage_partition: partition@f7000 {
			label = "storage";
			reg = <0x000f7000 0x00009000>;
		};
	};
};

Now, the previous bootloader warning has been removed, but bootloader does not swap to the secondary partition, I think something is wrong with the secondary partition. What does the arguments magic, swap_type and so on, mean?

Logs after flashing nRF with nrfjprog, both bootloader and application

00> *** Booting Zephyr OS build v2.4.99-ncs2-1  ***
00> I: Starting bootloader
00> I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: none
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping to the 
(Some LOGS or part of it is missing)


Logs after Bluetooth nrfConnect DFU

*** Booting Zephyr OS build v2.4.99-ncs2-1  ***
00> I: Starting bootloader
00> I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Secondary image: magic=bad, swap_type=0x0, copy_done=0x2, image_ok=0x2
00> I: Boot source: none
00> I: Swap type: none
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping to
(Some LOGS or part of it is missing)

Thanks and regards,

Jordi

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Einar Thorsrud — Wed, 01 Jun 2022 10:56:33 GMT

Hi Jordi,

Is your original project based on vanilla Zephyr, or a nRF Connect SDK release? I ask because the the "not a compatible amount of sectors" warning is printed in bootloader\mcuboot\boot\bootutil\src\swap_move.c should only happen with a non-nRF Connect SDK based MCUboot. With the bootloader you have, the number of sectors in the primary and secondary slot must be equal (or secondary slot one larger). What is your memory layout?

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Jorcis — Wed, 01 Jun 2022 07:38:38 GMT

Hi Einar,

[quote userid="7377" url="~/f/nordic-q-a/88267/how-to-sign-ncs-firmware-in-order-to-be-compatible-with-zephyr-bootloader/369709#369709"]Is the update successful seen from nRF Connect?[/quote]

Yes, the update is seen succesful

[quote userid="7377" url="~/f/nordic-q-a/88267/how-to-sign-ncs-firmware-in-order-to-be-compatible-with-zephyr-bootloader/369709#369709"]Can you share the logs?[/quote]

Log seen from nRF Connect:

D	09:24:33.898	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
D	09:24:33.901	gatt.setCharacteristicNotification(00002a19-0000-1000-8000-00805f9b34fb, true)
D	09:24:33.905	gatt.setCharacteristicNotification(0000ff01-0000-1000-8000-00805f9b34fb, true)
D	09:24:33.908	gatt.setCharacteristicNotification(0000ff02-0000-1000-8000-00805f9b34fb, true)
V	09:24:42.933	[McuMgr] Connecting...
D	09:24:42.943	[McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
D	09:24:43.017	[McuMgr] [Callback] Connection state changed with status: 0 and new state: 2 (CONNECTED)
I	09:24:43.025	[McuMgr] Connected to C1:36:CA:4E:E8:FB
D	09:24:43.034	[McuMgr] wait(300)
V	09:24:43.351	[McuMgr] Discovering services...
D	09:24:43.367	[McuMgr] gatt.discoverServices()
I	09:24:43.413	[McuMgr] Services discovered
V	09:24:43.421	[McuMgr] Primary service found
V	09:24:43.429	[McuMgr] Requesting new MTU...
D	09:24:43.436	[McuMgr] gatt.requestMtu(498)
I	09:24:43.536	[McuMgr] MTU changed to: 252
D	09:24:43.543	[McuMgr] gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
V	09:24:43.550	[McuMgr] Enabling notifications for da2e7828-fbce-4e01-ae9e-261174997c48
D	09:24:43.556	[McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
I	09:24:43.711	[McuMgr] Data written to descr. 00002902-0000-1000-8000-00805f9b34fb, value: (0x) 01-00
I	09:24:43.720	[McuMgr] Notifications enabled
A	09:24:43.745	[McuMgr] Sending (10 bytes) Header (Op: 0, Flags: 0, Len: 2, Group: 1, Seq: 0, Command: 0) CBOR {}
V	09:24:43.753	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	09:24:43.769	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	09:24:43.794	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 00-00-00-02-00-01-00-00-BF-FF
I	09:24:43.947	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 01-00-00-86-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-33-2E-30-2E-31-64-68-61-73-68-58-20-3D-2B-EE-5E-79-CC-D5-44-11-67-84-7C-5D-0D-57-8B-38-F0-86-F5-B4-86-C5-48-A1-C5-36-BC-79-D1-3D-71-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75-73-00-FF
A	09:24:43.964	[McuMgr] Received Header (Op: 1, Flags: 0, Len: 134, Group: 1, Seq: 0, Command: 0) CBOR {"images":[{"slot":0,"version":"3.0.1","hash":"PSvuXnnM1UQRZ4R8XQ1XizjwhvW0hsVIocU2vHnRPXE=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false}],"splitStatus":0}
V	09:24:43.997	[McuMgr] Uploading firmware...
A	09:27:00.588	[McuMgr] 379216 bytes sent in 136057 ms (2.79 kB/s)
A	09:27:00.604	[McuMgr] Sending (10 bytes) Header (Op: 2, Flags: 0, Len: 2, Group: 63, Seq: 185, Command: 0) CBOR {}
V	09:27:00.610	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	09:27:00.616	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	09:27:00.658	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-02-00-3F-B9-00-BF-FF
I	09:27:00.739	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-06-00-3F-B9-00-BF-62-72-63-08-FF
A	09:27:00.750	[McuMgr] Received Header (Op: 3, Flags: 0, Len: 6, Group: 63, Seq: 185, Command: 0) CBOR {"rc":8}
W	09:27:00.760	[McuMgr] Error: NOT_SUPPORTED (8)
V	09:27:00.787	[McuMgr] New state: TEST
A	09:27:00.810	[McuMgr] Sending (58 bytes) Header (Op: 2, Flags: 0, Len: 50, Group: 1, Seq: 186, Command: 0) CBOR {"confirm":false,"hash":"v4ytqbpIp4kLof0+WAQLAIHk89ZQivjzZ1smQ9Dvy9E="}
V	09:27:00.817	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	09:27:00.825	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	09:27:00.850	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-32-00-01-BA-00-BF-67-63-6F-6E-66-69-72-6D-F4-64-68-61-73-68-58-20-BF-8C-AD-A9-BA-48-A7-89-0B-A1-FD-3E-58-04-0B-00-81-E4-F3-D6-50-8A-F8-F3-67-5B-26-43-D0-EF-CB-D1-FF
I	09:27:01.056	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-F4-00-01-BA-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-33-2E-30-2E-31-64-68-61-73-68-58-20-3D-2B-EE-5E-79-CC-D5-44-11-67-84-7C-5D-0D-57-8B-38-F0-86-F5-B4-86-C5-48-A1-C5-36-BC-79-D1-3D-71-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-BF-64-73-6C-6F-74-01-67-76-65-72-73-69-6F-6E-65-33-2E-30-2E-31-64-68-61-73-68-58-20-BF-8C-AD-A9-BA-48-A7-89-0B-A1-FD-3E-58-04-0B-00-81-E4-F3-D6-50-8A-F8-F3-67-5B-26-43-D0-EF-CB-D1-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F5-69-63-6F-6E-66-69-72-6D-65-64-F4-66-61-63-74-69-76-65-F4-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75
I	09:27:01.063	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 73-00-FF
A	09:27:01.079	[McuMgr] Received Header (Op: 3, Flags: 0, Len: 244, Group: 1, Seq: 186, Command: 0) CBOR {"images":[{"slot":0,"version":"3.0.1","hash":"PSvuXnnM1UQRZ4R8XQ1XizjwhvW0hsVIocU2vHnRPXE=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false},{"slot":1,"version":"3.0.1","hash":"v4ytqbpIp4kLof0+WAQLAIHk89ZQivjzZ1smQ9Dvy9E=","bootable":true,"pending":true,"confirmed":false,"active":false,"permanent":false}],"splitStatus":0}
V	09:27:01.108	[McuMgr] New state: RESET
A	09:27:01.124	[McuMgr] Sending (10 bytes) Header (Op: 2, Flags: 0, Len: 2, Group: 0, Seq: 187, Command: 5) CBOR {}
V	09:27:01.131	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	09:27:01.139	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	09:27:01.166	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-02-00-00-BB-05-BF-FF
I	09:27:01.258	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-02-00-00-BB-05-BF-FF
A	09:27:01.272	[McuMgr] Received Header (Op: 3, Flags: 0, Len: 2, Group: 0, Seq: 187, Command: 5) CBOR {}
D	09:27:06.418	[Callback] Connection state changed with status: 8 and new state: DISCONNECTED (0)
E	09:27:06.419	Error 8 (0x8): GATT CONN TIMEOUT
I	09:27:06.419	Disconnected
D	09:27:06.498	[McuMgr] [Callback] Connection state changed with status: 8 and new state: 0 (DISCONNECTED)
W	09:27:06.512	[McuMgr] Error: (0x8): GATT CONN TIMEOUT
I	09:27:06.527	[McuMgr] Disconnected
D	09:27:06.540	[McuMgr] gatt.close()
D	09:27:06.554	[Broadcast] Action received: android.bluetooth.device.action.ACL_DISCONNECTED
V	09:27:11.318	[McuMgr] Connecting...
D	09:27:11.334	[McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
V	09:27:11.373	[McuMgr] New state: CONFIRM
D	09:27:14.040	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
D	09:27:14.042	[McuMgr] [Callback] Connection state changed with status: 0 and new state: 2 (CONNECTED)
I	09:27:14.066	[McuMgr] Connected to C1:36:CA:4E:E8:FB
D	09:27:14.082	[McuMgr] wait(300)
I	09:27:14.340	[McuMgr] Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
I	09:27:14.423	[McuMgr] PHY updated (TX: LE 2M, RX: LE 2M)
V	09:27:14.435	[McuMgr] Discovering services...
D	09:27:14.441	[McuMgr] gatt.discoverServices()
I	09:27:14.855	[McuMgr] Services discovered
V	09:27:14.863	[McuMgr] Primary service found
V	09:27:14.871	[McuMgr] Requesting new MTU...
D	09:27:14.879	[McuMgr] gatt.requestMtu(498)
I	09:27:14.924	[McuMgr] Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 5000ms)
I	09:27:14.972	[McuMgr] MTU changed to: 252
D	09:27:14.978	[McuMgr] gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
V	09:27:14.985	[McuMgr] Enabling notifications for da2e7828-fbce-4e01-ae9e-261174997c48
D	09:27:14.991	[McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
I	09:27:15.137	[McuMgr] Data written to descr. 00002902-0000-1000-8000-00805f9b34fb, value: (0x) 01-00
I	09:27:15.145	[McuMgr] Notifications enabled
A	09:27:15.170	[McuMgr] Sending (58 bytes) Header (Op: 2, Flags: 0, Len: 50, Group: 1, Seq: 0, Command: 0) CBOR {"confirm":true,"hash":"v4ytqbpIp4kLof0+WAQLAIHk89ZQivjzZ1smQ9Dvy9E="}
V	09:27:15.179	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	09:27:15.196	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	09:27:15.220	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-32-00-01-00-00-BF-67-63-6F-6E-66-69-72-6D-F5-64-68-61-73-68-58-20-BF-8C-AD-A9-BA-48-A7-89-0B-A1-FD-3E-58-04-0B-00-81-E4-F3-D6-50-8A-F8-F3-67-5B-26-43-D0-EF-CB-D1-FF
I	09:27:15.510	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-F4-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-33-2E-30-2E-31-64-68-61-73-68-58-20-3D-2B-EE-5E-79-CC-D5-44-11-67-84-7C-5D-0D-57-8B-38-F0-86-F5-B4-86-C5-48-A1-C5-36-BC-79-D1-3D-71-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-BF-64-73-6C-6F-74-01-67-76-65-72-73-69-6F-6E-65-33-2E-30-2E-31-64-68-61-73-68-58-20-BF-8C-AD-A9-BA-48-A7-89-0B-A1-FD-3E-58-04-0B-00-81-E4-F3-D6-50-8A-F8-F3-67-5B-26-43-D0-EF-CB-D1-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F5-69-63-6F-6E-66-69-72-6D-65-64-F4-66-61-63-74-69-76-65-F4-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75
I	09:27:15.545	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 73-00-FF
A	09:27:15.568	[McuMgr] Received Header (Op: 3, Flags: 0, Len: 244, Group: 1, Seq: 0, Command: 0) CBOR {"images":[{"slot":0,"version":"3.0.1","hash":"PSvuXnnM1UQRZ4R8XQ1XizjwhvW0hsVIocU2vHnRPXE=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false},{"slot":1,"version":"3.0.1","hash":"v4ytqbpIp4kLof0+WAQLAIHk89ZQivjzZ1smQ9Dvy9E=","bootable":true,"pending":true,"confirmed":false,"active":false,"permanent":false}],"splitStatus":0}
V	09:27:15.629	[McuMgr] Disconnecting...
D	09:27:15.635	[McuMgr] gatt.disconnect()
D	09:27:15.681	[McuMgr] [Callback] Connection state changed with status: 0 and new state: 0 (DISCONNECTED)
I	09:27:15.687	[McuMgr] Disconnected
D	09:27:15.700	[McuMgr] gatt.close()
D	09:27:15.723	gatt.close()
D	09:27:15.729	wait(200)
V	09:27:15.934	Connecting to C1:36:CA:4E:E8:FB...

Log seen from the bootloader:

00> *** Booting Zephyr OS build v2.4.99-ncs2-1  ***
00> I: Starting bootloader
00> W: Cannot upgrade: not a compatible amount of sectors
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping*** Booting Zephyr OS build v2.4.99-ncs2-1  ***
00> I: Starting bootloader
00> W: Cannot upgrade: not a compatible amount of sectors
00> I: Bootloader c

Does this suggest anything to you? Please let me know if you need more information.

Thanks and regards,

Jordi

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Einar Thorsrud — Fri, 27 May 2022 06:17:56 GMT

Hi Jordi,

[quote user="Jorcis"]Which are the proper CONFIGs for setting a custom BOOT_SIGNATURE_KEY_FILE?[/quote]

You can use CONFIG_BOOT_SIGNATURE_KEY_FILE and provide the absolute path to the key file.

[quote user="Jorcis"]What is wrong with the DFU app_update?[/quote]

Good question. Is the update successful seen from nRF Connect? Can you share the logs? It could be interesting with logs from the nRF as well (both from your application and MCUboot).

RE: How to sign NCS firmware in order to be compatible with Zephyr bootloader

Jorcis — Wed, 25 May 2022 12:33:00 GMT

Hi again,

I've made some progress on the issue but still have need for support.

I've used the following configuration for the new project:

CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_MCUBOOT_BUILD_STRATEGY_FROM_SOURCE=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="my_key.pem"
CONFIG_MCUBOOT_GENERATE_CONFIRMED_IMAGE=y
CONFIG_DISABLE_FLASH_PATCH=y

The problem with these CONFIG, is that they don't build using "my_key.pem" but the "bootloader/mcuboot/root-ec-p256.pem" default one is used instead. After building I have to execute manually the imgtool sentences, substituting the default key for my_key:

/usr/bin/python3.10 bootloader/mcuboot/scripts/imgtool.py sign --key my_key.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x70000 --pad-header build/zephyr/mcuboot_primary_app.hex build/zephyr/app_signed.hex && 
~/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/arm-zephyr-eabi-objcopy --input-target=ihex --output-target=binary --gap-fill=0xff build/zephyr/mcuboot_primary_app.hex build/zephyr/app_to_sign.bin && 
/usr/bin/python3.10 bootloader/mcuboot/scripts/imgtool.py sign --key my_key.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x70000 --pad-header build/zephyr/app_to_sign.bin build/zephyr/app_update.bin && 
/usr/bin/python3.10 bootloader/mcuboot/scripts/imgtool.py sign --key my_key.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x70000 --pad-header --pad build/zephyr/mcuboot_primary_app.hex build/zephyr/app_test_update.hex && 
/home/jc/zephyr-sdk-0.13.2/arm-zephyr-eabi/bin/arm-zephyr-eabi-objcopy --input-target=ihex --output-target=ihex --change-address 0x70000 --gap-fill=0xff build/zephyr/app_test_update.hex build/zephyr/app_moved_test_update.hex

/usr/bin/python3.10 nrf/scripts/bootloader/generate_zip.py --bin-files build/zephyr/app_update.bin --output build/zephyr/dfu_application.zip load_address=0xc200 version_MCUBOOT=0.0.0+0 type=application board=nrf52840_wbolt soc=nRF52840_QIAA

/usr/bin/python3.10 ../zephyr/scripts/mergehex.py -o build/zephyr/merged.hex --overlap=replace build/mcuboot/zephyr/zephyr.hex build/zephyr/mcuboot_primary.hex build/zephyr/zephyr.hex build/zephyr/app_signed.hex

Doing that, I can flash the build/zephyr/app_signed.hex with nrfjprog --program instruction, and the program runs OK.

But flashing the file app_update.bin with nRFConnect DFU is unsuccessful, i.e., the binary is flashed at slot_1 (0x72000) but the old program at slot_0 is the one that runs.

Questions are:

Which are the proper CONFIGs for setting a custom BOOT_SIGNATURE_KEY_FILE?
What is wrong with the DFU app_update?

Regads,

Jordi