MCUBOOT signature key file with NCS V2.0.0

RE: MCUBOOT signature key file with NCS V2.0.0

mytzyiay — Fri, 17 Jun 2022 01:03:08 GMT

I've researched how Zephyr's original extra_kconfig_options logic works, and it really doesn't seem like the extra escaping belongs on the west command line. This bug is caused by NCS failing to properly escape the strings before writing them into the image_preload files.

i.e. an option of the form -D"mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"abc\"" is correct in the cmake cache but it gets mangled once Nordic's multi_image.cmake script writes it out into the image_preload file.

Could you please take a look at https://github.com/nrfconnect/sdk-nrf/pull/7997

RE: MCUBOOT signature key file with NCS V2.0.0

hjetschko — Thu, 16 Jun 2022 21:37:50 GMT

Hi Amanda

Thank you, your solution works very well

RE: MCUBOOT signature key file with NCS V2.0.0

obiwan_kenobi — Thu, 16 Jun 2022 10:33:41 GMT

I've also tested it out, worked for me (:
Thanks a lot for your help.

-Ben-

RE: MCUBOOT signature key file with NCS V2.0.0

Amanda Hsieh — Thu, 16 Jun 2022 09:31:02 GMT

Hi,

Sorry for the mistake.

After https://github.com/nrfconnect/sdk-nrf/commit/5393942bdf24be8424ec382f11e40083b01593c7 it is no longer possible to set a child image Kconfig string variable using the following command line flag: -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"abc\". It results in CONFIG_BOOT_SIGNATURE_KEY_FILE=abc"" being put in build/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf.

The only workaround is using another layer of escaping: -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\\\"abc\\\".

I have tested with the following command and don't get any issue.

west build --pristine -b nrf52840dk_nrf52840 zephyr/samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\\\"C:/NCS_2/v2.0.0/bootloader/mcuboot/enc-ec256-priv.pem\\\" -DCONFIG_MCUBOOT_IMAGE_VERSION=\"0.1.2\+3\" -Dmcuboot_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y

I think this could fix the issue while using -Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE with the command or setting mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE in CMake.

-Amanda

RE: MCUBOOT signature key file with NCS V2.0.0

obiwan_kenobi — Thu, 16 Jun 2022 08:22:17 GMT

Could you try with <Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE> instead of <DCONFIG_MCUBOOT_SIGNATURE_KEY_FILE> ?

Reference:
developer.nordicsemi.com/.../ug_bootloader_adding.html

RE: MCUBOOT signature key file with NCS V2.0.0

Amanda Hsieh — Thu, 16 Jun 2022 08:18:03 GMT

Hi,

I can build without issue with the following command:

west build --pristine -b nrf52840dk_nrf52840 zephyr/samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y -DCONFIG_MCUBOOT_SIGNATURE_KEY_FILE=\"bootloader/mcuboot/root-rsa-2048.pem\" -DCONFIG_MCUBOOT_IMAGE_VERSION=\"0.1.2\+3\"

-Amanda

RE: MCUBOOT signature key file with NCS V2.0.0

obiwan_kenobi — Wed, 15 Jun 2022 15:35:29 GMT

This is an alternative, but it doesn't cancel out the fact that we might have encountered a regression when passing <-Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE> to the <west build> command, or when using CMake to set <mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE>.

It should just work, because it is written in the official documentation:

developer.nordicsemi.com/.../ug_bootloader_adding.html

RE: MCUBOOT signature key file with NCS V2.0.0

mytzyiay — Wed, 15 Jun 2022 14:56:00 GMT

That's what I am doing now as a workaround. Could we please get the regression fixed in the next NCS release?

RE: MCUBOOT signature key file with NCS V2.0.0

Amanda Hsieh — Wed, 15 Jun 2022 09:03:27 GMT

Hi,

Please follow Leo Xing's suggestion to create the child_image folder and contain the mcuboot.conf.

-Amanda

RE: MCUBOOT signature key file with NCS V2.0.0

mytzyiay — Tue, 14 Jun 2022 17:10:01 GMT

I see the same problem when trying to pass mcuboot options on the west command line using NCS v2.0.0:

 west build --pristine -b nrf52840dk_nrf52840 -- \
 -D"mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"$(shell pwd)/private.pem\"" \
 -D"CONFIG_MCUBOOT_IMAGE_VERSION=\"$(shell ./scripts/unix-time-to-version.sh)\""

The build system errors out with an escaping error for mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE but not for CONFIG_MCUBOOT_IMAGE_VERSION. In this case I also see the two quotes at the end of the value, rather than the value being surrounded by one quote on each side.

Seems like a regression?

RE: MCUBOOT signature key file with NCS V2.0.0

leox — Tue, 14 Jun 2022 03:45:13 GMT

Hi Hubert,

adding Kconfig options to <your project folder>/child_image/mcuboot.conf which will pass to MCUBoot build. e.g: these could be placed to here; example: v2.0.0\nrf\applications\serial_lte_modem\child_image