Error about MCUBOOT_BUILD_STRATEGY_FROM_SOURCE when trying to provide a signing key

[AndreKR]

I want to do firmware updates over BLE. To do that I added these settings to my prj.conf which I mostly got from the smp_svr example:

# For BLE firmware updates
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_MCUMGR=y
CONFIG_MCUMGR_CMD_IMG_MGMT=y # for writing new firmware
CONFIG_MCUMGR_CMD_OS_MGMT=y # for resetting the device
CONFIG_BT_L2CAP_TX_MTU=252
CONFIG_BT_BUF_ACL_RX_SIZE=256
CONFIG_MCUMGR_SMP_BT=y
CONFIG_MCUMGR_SMP_BT_AUTHEN=n # security is handled by signed firmware images
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

This "works" but it uses the default signing key. So I added CONFIG_MCUBOOT_SIGNATURE_KEY_FILE="signing_key.pem" according to this answer but I got this message during build:

  CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is set to "signing_key.pem".

  You are using the NCS Mcuboot signing, which means this option will be
  ignored.

  Image signing in NCS is done via the MCUboot image's
  CONFIG_BOOT_SIGNATURE_KEY_FILE option.

  Consider setting CONFIG_MCUBOOT_SIGNATURE_KEY_FILE in your application
  image back to its default value, the empty string.

If I follow that advice and set CONFIG_BOOT_SIGNATURE_KEY_FILE I get these messages:

CONFIG_BOOT_SIGNATURE_KEY_FILE couldn't be set. Missing dependencies:
!MCUBOOT_BUILD_STRATEGY_FROM_SOURCE

warning: BOOT_SIGNATURE_KEY_FILE was assigned the value 'signing_key.pem' but got the value
''. Check these unsatisfied dependencies: (!MCUBOOT_BUILD_STRATEGY_FROM_SOURCE) (=n). See
http://docs.zephyrproject.org/latest/reference/kconfig/CONFIG_BOOT_SIGNATURE_KEY_FILE.html and/or
look up BOOT_SIGNATURE_KEY_FILE in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual

But it doesn't seem like MCUBOOT_BUILD_STRATEGY_FROM_SOURCE is a valid prj.conf setting for an NCS project?

I'm on NCS 1.9.1.

[dejans]

Hi,

If I follow that advice and set CONFIG_BOOT_SIGNATURE_KEY_FILE

The message instructed you to consider setting CONFIG_MCUBOOT_SIGNATURE_KEY_FILE. Did you set CONFIG_BOOT_SIGNATURE_KEY_FILE instead? If so, to which value?

Best regards,
Dejan

[AndreKR]

Are you referring to the last sentence of the message? If I understand the message correctly, it encourages me to remove (= set to the default, an empty string) CONFIG_MCUBOOT_SIGNATURE_KEY_FILE again just to get rid of the message. But then I would still not have a custom signing key.

[dejans]

Hi,

Could you specify the way how you built your project?

Best regards,
Dejan

[AndreKR]

Here's my complete prj.conf:

CONFIG_CONSOLE=y
CONFIG_RTT_CONSOLE=y
CONFIG_USE_SEGGER_RTT=y
CONFIG_DEBUG_THREAD_INFO=y
CONFIG_DEBUG_OPTIMIZATIONS=y
CONFIG_SPI=y
CONFIG_I2C=y
CONFIG_SERIAL=y
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_ADC=y
CONFIG_BT=y
CONFIG_WATCHDOG=y

# For BLE firmware updates
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_MCUMGR=y
CONFIG_MCUMGR_CMD_IMG_MGMT=y # for writing new firmware
CONFIG_MCUMGR_CMD_OS_MGMT=y # for resetting the device
CONFIG_BT_L2CAP_TX_MTU=252
CONFIG_BT_BUF_ACL_RX_SIZE=256
CONFIG_MCUMGR_SMP_BT=y
CONFIG_MCUMGR_SMP_BT_AUTHEN=n # security is handled by signed firmware images
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

If you just create a new project in VSCode and hit Build, you should get a message about the default key being used.

If you then add CONFIG_MCUBOOT_SIGNATURE_KEY_FILE you should see the message about it being ignored.

[dejans]

Hi,

Similar to what is shown in the configuration file for nrf_desktop sample, you should put CONFIG_BOOT_SIGNATURE_KEY_FILE in the configuration file for the child image. Inside your project directory, create child_image directory with mcuboot.conf file where you put your mcuboot configuration. If you still have an issue, try adding CONFIG_BOOT_SIGNATURE_KEY_FILE in both prj.conf and in child_image/mcuboot.conf

You can read more about default configuration for multi-image build, signing binaries and adding custom signature key file.

Best regards,
Dejan