MCUBOOT signature key file with NCS V2.0.0

[hjetschko]

Hi, we are trying to compile our project with NCS V2.0.0. Currently we are using NCS V1.8.0. In CMakeLists.txt we have this line to pass a custom signature key file to MCUBoot:

# MCUboot: set certificate file
set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE "\"${CMAKE_CURRENT_LIST_DIR}/key/airbolt-rsa-2048.pem\"")

When compiling with NCS V1.8.0 we get this output and everything works:

When compiling with NCS V2.0.0 we get this error:

Next I looked in the extra_kconfig_options.conf file that was generated for MCUBoot:

Instead of putting the string between the quotation marks it was added to the end, causing the compile error.

Is there a better way of passing the signature key fle to MCUBoot?

[mytzyiay]

I see the same problem when trying to pass mcuboot options on the west command line using NCS v2.0.0:

 west build --pristine -b nrf52840dk_nrf52840 -- \
 -D"mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"$(shell pwd)/private.pem\"" \
 -D"CONFIG_MCUBOOT_IMAGE_VERSION=\"$(shell ./scripts/unix-time-to-version.sh)\""

The build system errors out with an escaping error for mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE but not for CONFIG_MCUBOOT_IMAGE_VERSION.  In this case I also see the two quotes at the end of the value, rather than the value being surrounded by one quote on each side.

Seems like a regression?

[Amanda Hsieh]

Hi, 

Please follow Leo Xing's suggestion to create the child_image folder and contain the mcuboot.conf. 

-Amanda

[mytzyiay]

That's what I am doing now as a workaround.  Could we please get the regression fixed in the next NCS release?

[Amanda Hsieh]

Hi, 

I can build without issue with the following command: 

west build --pristine -b nrf52840dk_nrf52840 zephyr/samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y -DCONFIG_MCUBOOT_SIGNATURE_KEY_FILE=\"bootloader/mcuboot/root-rsa-2048.pem\" -DCONFIG_MCUBOOT_IMAGE_VERSION=\"0.1.2\+3\"

-Amanda

[obiwan_kenobi]

Could you try with <Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE> instead of <DCONFIG_MCUBOOT_SIGNATURE_KEY_FILE> ?

Reference:
developer.nordicsemi.com/.../ug_bootloader_adding.html

[Amanda Hsieh]

Hi, 

Sorry for the mistake. 

After https://github.com/nrfconnect/sdk-nrf/commit/5393942bdf24be8424ec382f11e40083b01593c7 it is no longer possible to set a child image Kconfig string variable using the following command line flag: -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"abc\". It results in CONFIG_BOOT_SIGNATURE_KEY_FILE=abc"" being put in build/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf.

The only workaround is using another layer of escaping: -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\\\"abc\\\".

I have tested with the following command and don't get any issue. 

west build --pristine -b nrf52840dk_nrf52840 zephyr/samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\\\"C:/NCS_2/v2.0.0/bootloader/mcuboot/enc-ec256-priv.pem\\\" -DCONFIG_MCUBOOT_IMAGE_VERSION=\"0.1.2\+3\" -Dmcuboot_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y

I think this could fix the issue while using -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE with the command or setting mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE in CMake.

-Amanda

[obiwan_kenobi]

I've also tested it out, worked for me (:
Thanks a lot for your help.

-Ben-

[mytzyiay]

I've researched how Zephyr's original extra_kconfig_options logic works, and it really doesn't seem like the extra escaping belongs on the west command line.  This bug is caused by NCS failing to properly escape the strings before writing them into the image_preload files.

i.e. an option of the form -D"mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"abc\"" is correct in the cmake cache but it gets mangled once Nordic's multi_image.cmake script writes it out into the image_preload file.

Could you please take a look at https://github.com/nrfconnect/sdk-nrf/pull/7997