MCUBOOT Sign the firmware

RE: MCUBOOT Sign the firmware

user113934 — Thu, 02 Jun 2022 18:17:01 GMT

[quote userid="7377" url="~/f/nordic-q-a/88416/mcuboot-sign-the-firmware/370586#370586"]With regard to relative paths that is a common request but there are no elegant ways to do this for now.[/quote]

I second this request. It's very common in our environment for multiple developers to clone the project into their respective home directories on MacOS/Linux, which will have different absolute paths. Requiring them to fix up the .config options adds an unnecessary point of failure to the build process.

RE: MCUBOOT Sign the firmware

user7377 — Thu, 02 Jun 2022 07:24:05 GMT

Hi,

When you build an application and enable MCUboot, that will also be built as a child image (which is a build system concept). In recent nRF Connect SDK releases, you can add a configuration overlay under child_image/<child_image_name>.conf. This also works for other overlays. When you do this, it is automatically picked up by the build system and applied.

With regard to relative paths that is a common request but there are no elegant ways to do this for now.

RE: MCUBOOT Sign the firmware

user102708 — Wed, 01 Jun 2022 13:39:03 GMT

I'm fine with ECDSA key. But it would be great to find something that works for setting a relative path towards the key, since the suggestions I've found didn't work.
Also I'd like to understand what child_image/mcuboot.conf changes. Why I have to do it this way, and why it's enough just to add this file without linking it anywhere.

RE: MCUBOOT Sign the firmware

user7377 — Wed, 01 Jun 2022 12:52:55 GMT

Hi,

RSA should work and is the default key type. You can see for instance this post which includes a sample project with a custom RSA key.

RE: MCUBOOT Sign the firmware

user102708 — Tue, 31 May 2022 16:29:34 GMT

I was able to sign with a full path. But the suggestion for the relative path doesn't work, I get an error:

CMake Error at /home/aleksa/Desktop/01_POSAO/02_UPWORK/04_PENNY/01_MG105_NCS191/mg105-nrf9160-root/lib/nordic/ncs/nrf/cmake/multi_image.cmake:409 (message):
  CMake generation for mcuboot failed, aborting.  Command: 1
Call Stack (most recent call first):
  /home/aleksa/Desktop/01_POSAO/02_UPWORK/04_PENNY/01_MG105_NCS191/mg105-nrf9160-root/lib/nordic/ncs/nrf/cmake/multi_image.cmake:150 (add_child_image_from_source)
  /home/aleksa/Desktop/01_POSAO/02_UPWORK/04_PENNY/01_MG105_NCS191/mg105-nrf9160-root/lib/nordic/ncs/nrf/modules/mcuboot/CMakeLists.txt:216 (add_child_image)

Also, I don't understand why I had to make child_image/mcuboot.conf file. Signing works only when I put there the config below, but I see no logic behind it. Here is the config:

CONFIG_BOOT_SIGNATURE_TYPE_RSA=n
CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="path/to/private.pem"
# CONFIG_BOOT_SIGNATURE_KEY_FILE="private.pem"

Also, it doesn't work when I try to use RSA instead of ECDSA (and fix their respective configs of course). Again, I see no reason why it would behave this way.

RE: MCUBOOT Sign the firmware

user7377 — Tue, 31 May 2022 11:39:05 GMT

Hi Aleksa,

You need to specify a full path to the key file. Alternatively, you can do as described here.