mcuboot: Make ED25519 signature default for nrf54l series #19148

de-nordic · 2024-11-28T16:51:59Z

MCUboot for nRF54l15 will be built with support for ED25519 by default and application images will be signed with ED25519 signature.
The MCUboot partition size, for this configuration, is set to 0xd000.

NordicBuilder · 2024-11-28T16:55:26Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 18

Inputs:

Sources:

sidewalk: PR head: 43d1b1c52eab4942fc957c671a9a82219456c7dd
sdk-nrf: PR head: 46342c3c580a056fd15ff7eb42ad0df4f6ac61e6
mcuboot: PR head: c82defabd990a6db8cd2cb230e668de7f9238f07

more details

sidewalk:

PR head: 43d1b1c52eab4942fc957c671a9a82219456c7dd
merge base: 1a811c356150a4ccc58d644d110524c33342e3a1
target head (main): 0632715d29c7e1b7bd6f999b12461fb6ebde36c9
Diff

sdk-nrf:

PR head: 46342c3c580a056fd15ff7eb42ad0df4f6ac61e6
merge base: ef172cdb46c29326938e19c3f7cd99f5af3187e4
target head (main): ef172cdb46c29326938e19c3f7cd99f5af3187e4
Diff

mcuboot:

PR head: c82defabd990a6db8cd2cb230e668de7f9238f07
merge base: 12e5ee106034972b0f1074d6f2261b2b39d1501b
target head (main): b82206c15fff357c151c24bf97c99c4348d14a46
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (20)

bootloader
│  ├── mcuboot
│  │  ├── scripts
│  │  │  ├── imgtool
│  │  │  │  │ main.py
modules
│  ├── mcuboot
│  │  ├── boot
│  │  │  ├── zephyr
│  │  │  │  │ Kconfig
sidewalk
│  ├── samples
│  │  ├── sid_end_device
│  │  │  ├── pm_static_nrf54l15dk_nrf54l10_cpuapp.yml
│  │  │  ├── sysbuild
│  │  │  │  ├── mcuboot
│  │  │  │  │  ├── boards
│  │  │  │  │  │  │ nrf54l15dk_nrf54l10_cpuapp.conf
│  │  │  │  │  │ prj.conf
│  ├── tests
│  │  ├── manual
│  │  │  ├── simple_bootloader
│  │  │  │  ├── Kconfig.sysbuild
│  │  │  │  ├── boards
│  │  │  │  │  ├── nrf54l15dk_nrf54l10_cpuapp.conf
│  │  │  │  │  │ nrf54l15dk_nrf54l10_cpuapp.overlay
│  │  │  │  ├── pm_static_nrf54l15dk_nrf54l10_cpuapp.yml
│  │  │  │  ├── sysbuild
│  │  │  │  │  ├── mcuboot
│  │  │  │  │  │  ├── boards
│  │  │  │  │  │  │  ├── nrf52840dk_nrf52840.conf
│  │  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp.conf
│  │  │  │  │  │  │  ├── nrf54l15dk_nrf54l10_cpuapp.conf
│  │  │  │  │  │  │  ├── nrf54l15dk_nrf54l10_cpuapp.overlay
│  │  │  │  │  │  │  ├── nrf54l15dk_nrf54l15_cpuapp.conf
│  │  │  │  │  │  │  ├── nrf54l15dk_nrf54l15_cpuapp.overlay
│  │  │  │  │  │  │  │ thingy53_nrf5340_cpuapp.conf
│  │  │  │  │  │  │ prj.conf
sysbuild
│  │ Kconfig.mcuboot
tests
│  ├── subsys
│  │  ├── nrf_compress
│  │  │  ├── decompression
│  │  │  │  ├── mcuboot_update
│  │  │  │  │  │ sysbuild.cmake
west.yml

Outputs:

Toolchain

Version: b77d8c1312
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:b77d8c1312_912848a074

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
✅ Integration tests
- ✅ test-sdk-audio
- ✅ desktop52_verification
- ✅ test-fw-nrfconnect-boot
- ✅ test-fw-nrfconnect-apps
- ✅ test_ble_nrf_config
- ✅ test-fw-nrfconnect-ble_mesh
- ✅ test-fw-nrfconnect-ble_samples
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nfc
- ✅ test-fw-nrfconnect-nrf-iot_libmodem-nrf
- ✅ test-fw-nrfconnect-nrf-iot_serial_lte_modem
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- ✅ test-fw-nrfconnect-nrf-iot_samples
- ✅ test-fw-nrfconnect-nrf-iot_lwm2m
- ✅ doc-internal
- ✅ test-fw-nrfconnect-nrf-iot_thingy91
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-rpc
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-fem
- ✅ test-fw-nrfconnect-tfm
- ✅ test-fw-nrfconnect-thread
- ✅ test-fw-nrfconnect-zigbee
- ✅ test-sdk-find-my
- ✅ test-fw-nrfconnect-nrf-iot_mosh
- ✅ test-fw-nrfconnect-nrf-iot_positioning
- ✅ test-sdk-sidewalk
- ✅ test-sdk-wifi
- ✅ test-low-level
- ✅ test-fw-nrfconnect-nrf-iot_nrf_provisioning
- ✅ test-sdk-pmic-samples
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu
- ✅ test-fw-nrfconnect-ps
- ✅ test-secdom-samples-public
- ⚠️ test-fw-nrfconnect-fw-update

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-11-28T17:09:03Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

de-nordic · 2024-11-28T19:41:56Z

@nvlsianpu The CI failures are caused by samples overriding mbedtls configuration file from nrf-security to something else.

LuDuda · 2024-11-28T19:44:47Z

@maciejbaczmanski could you please take a look, to ensure we use default configuration.

MarekPieta

Looks good

maciejbaczmanski

#19178 should unblock the PR and fix building matter samples

de-nordic · 2024-12-03T13:41:16Z

@maciejbaczmanski We got some compliance issue regarding non-existing Kconfig WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT

maciejbaczmanski · 2024-12-03T13:43:05Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

@@ -351,6 +351,13 @@ Matter samples
 * Updated all Matter samples that support low-power mode to enable the :ref:`lib_ram_pwrdn` feature.


just noticed that when copying and pasting I've left this point here. it should be removed as it is covered under Updated:

maciejbaczmanski · 2024-12-03T13:56:04Z

@maciejbaczmanski We got some compliance issue regarding non-existing Kconfig WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT

rebasing helped on my previous PR

de-nordic · 2024-12-03T14:19:43Z

Needed to do rebase and force push to remove conflicts.

Align Sidewalk with nRF changes in: nrfconnect/sdk-nrf#19148 Signed-off-by: Krzysztof Taborowski <[email protected]>

ktaborowski · 2024-12-04T09:27:51Z

nrfconnect/sdk-sidewalk#652 workaround for build issue on sidewalk samples on nrf54l10 - increase mcuboot partition

NordicBuilder · 2024-12-04T09:35:50Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
mcuboot	nrfconnect/sdk-mcuboot@`b82206c` (`main`)	nrfconnect/sdk-mcuboot#389	nrfconnect/sdk-mcuboot#389/files
sidewalk	nrfconnect/sdk-sidewalk@`1a811c3`	nrfconnect/sdk-sidewalk#666	nrfconnect/sdk-sidewalk#666/files

⛔ DNM label due to: 2 projects with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

shanthanordic · 2024-12-04T20:32:13Z

as I understand from @barsok This is not mandate for 2.9.0, as the PR is not yet ready with review and dependant merges moving it out of 2.9.0 milestone

gchwier · 2024-12-05T10:14:18Z

Failed sample: tests/subsys/nrf_compress/decompression/mcuboot_update

west build -p -b nrf54l15dk/nrf54l15/cpuapp tests/subsys/nrf_compress/decompression/mcuboot_update -T nrf_compress.decompression.mcuboot_update -d build-54l-decompr
west flash --skip-rebuild -d build-54l-decompr
and received:

I: Starting bootloader
I: Image index: 0, Swap type: perm
E: Image in the secondary slot is not valid!
I: Bootloader chainload address offset: 0x10000
*** Booting nRF Connect SDK v2.8.99-1e915cfea3cb ***
*** Using Zephyr OS v3.7.99-15ffa301b329 ***
[00:00:04.033,551] <err> mcuboot_update: Invalid header

* all platforms: size optimization in mcuboot * nrf54L: ed25519 signature as default (from nrf) nrfconnect/sdk-nrf#19148 * nrf54L10: link time optimization in mcuboot * nrf54L10: mcuboot partition size set to 52 KB Signed-off-by: Krzysztof Taborowski <[email protected]>

nordicjm

needs:

if(SB_CONFIG_SOC_SERIES_NRF54LX AND SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519)
  set_config_bool(compressed_app CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_ED25519 y)
  set_config_bool(compressed_app CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 y)
  set_config_bool(compressed_app CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
endif()

adding to tests/subsys/nrf_compress/decompression/mcuboot_update/sysbuild.cmake
Also needs nrfconnect/sdk-mcuboot#389

sha512 compression fix Signed-off-by: Mateusz Michalek <[email protected]>

mcuboot size changes Signed-off-by: Krzysztof Taborowski <[email protected]>

MCUboot for nRF54l15 will be built with support for ED25519 by default and application images will be signed with ED25519 signature. The MCUboot partition size, for this configuration, is set to 0xd000. Signed-off-by: Dominik Ermel <[email protected]> Signed-off-by: Marek Pieta <[email protected]>

Enable ED25519 for nrf54l by default. Signed-off-by: Dominik Ermel <[email protected]>

de-nordic · 2024-12-19T15:40:36Z

@ktaborowski Can you take a look at CI, it seems that some part of application no longer fits in flash.

* all platforms: size optimization in mcuboot * nrf54L: ed25519 signature as default (from nrf) nrfconnect/sdk-nrf#19148 * nrf54L10: link time optimization in mcuboot * nrf54L10: mcuboot partition size set to 52 KB Signed-off-by: Krzysztof Taborowski <[email protected]>

de-nordic requested a review from a team as a code owner November 28, 2024 16:51

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 28, 2024

de-nordic mentioned this pull request Nov 28, 2024

applications: nrf_desktop: nRF54L - Mcuboot using HW crypto and KMU #19035

Merged

nordicjm approved these changes Nov 29, 2024

View reviewed changes

MarekPieta approved these changes Dec 2, 2024

View reviewed changes

nvlsianpu approved these changes Dec 3, 2024

View reviewed changes

maciejbaczmanski approved these changes Dec 3, 2024

View reviewed changes

de-nordic mentioned this pull request Dec 3, 2024

samples: matter: bootloader size optimizations #19178

Closed

de-nordic requested review from a team as code owners December 3, 2024 13:38

github-actions bot added doc-required PR must not be merged without tech writer approval. and removed changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Dec 3, 2024

maciejbaczmanski reviewed Dec 3, 2024

View reviewed changes

de-nordic force-pushed the ed25519_by_default branch from e39f5db to 5c1aabb Compare December 3, 2024 14:08

de-nordic added this to the 2.9.0 milestone Dec 3, 2024

peknis approved these changes Dec 3, 2024

View reviewed changes

de-nordic force-pushed the ed25519_by_default branch from 5c1aabb to 9a1e258 Compare December 3, 2024 14:19

ktaborowski added a commit to ktaborowski/sdk-sidewalk that referenced this pull request Dec 4, 2024

samples: new mcuboot configuration

778216f

Align Sidewalk with nRF changes in: nrfconnect/sdk-nrf#19148 Signed-off-by: Krzysztof Taborowski <[email protected]>

ktaborowski mentioned this pull request Dec 4, 2024

samples: new mcuboot configuration nrfconnect/sdk-sidewalk#652

Merged

5 tasks

de-nordic requested a review from a team as a code owner December 4, 2024 09:34

github-actions bot added the manifest label Dec 4, 2024

shanthanordic removed this from the 2.9.0 milestone Dec 4, 2024

shanthanordic requested a review from gchwier December 5, 2024 09:12

de-nordic force-pushed the ed25519_by_default branch 2 times, most recently from cfb6419 to 89d0cf5 Compare December 5, 2024 15:36

github-actions bot added changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. and removed doc-required PR must not be merged without tech writer approval. labels Dec 5, 2024

de-nordic force-pushed the ed25519_by_default branch from 89d0cf5 to 967269d Compare December 13, 2024 09:00

ktaborowski mentioned this pull request Dec 13, 2024

samples: new mcuboot configuration nrfconnect/sdk-sidewalk#666

Open

5 tasks

de-nordic force-pushed the ed25519_by_default branch from 967269d to 8248520 Compare December 13, 2024 11:48

nordicjm reviewed Dec 16, 2024

View reviewed changes

de-nordic force-pushed the ed25519_by_default branch from 8248520 to 76d640a Compare December 17, 2024 09:27

NordicBuilder added the manifest-mcuboot label Dec 17, 2024

de-nordic force-pushed the ed25519_by_default branch 3 times, most recently from 4ad3896 to 86cbaf4 Compare December 18, 2024 13:42

gchwier approved these changes Dec 19, 2024

View reviewed changes

michalek-no and others added 4 commits December 19, 2024 12:14

manifest: update mcuboot

4a50019

sha512 compression fix Signed-off-by: Mateusz Michalek <[email protected]>

manifest: update sidewalk revision

51dcfbc

mcuboot size changes Signed-off-by: Krzysztof Taborowski <[email protected]>

tests: nrf_compress: decompression: Enable ED25519

46342c3

Enable ED25519 for nrf54l by default. Signed-off-by: Dominik Ermel <[email protected]>

de-nordic force-pushed the ed25519_by_default branch from 86cbaf4 to 46342c3 Compare December 19, 2024 12:14

de-nordic removed the DNM label Dec 19, 2024

de-nordic self-assigned this Dec 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

mcuboot: Make ED25519 signature default for nrf54l series #19148

mcuboot: Make ED25519 signature default for nrf54l series #19148

de-nordic commented Nov 28, 2024

NordicBuilder commented Nov 28, 2024 •

edited

Loading

NordicBuilder commented Nov 28, 2024

de-nordic commented Nov 28, 2024

LuDuda commented Nov 28, 2024

MarekPieta left a comment

maciejbaczmanski left a comment

de-nordic commented Dec 3, 2024

maciejbaczmanski Dec 3, 2024

maciejbaczmanski commented Dec 3, 2024

de-nordic commented Dec 3, 2024

ktaborowski commented Dec 4, 2024

NordicBuilder commented Dec 4, 2024 •

edited

Loading

shanthanordic commented Dec 4, 2024

gchwier commented Dec 5, 2024

nordicjm left a comment

de-nordic commented Dec 19, 2024

		@@ -351,6 +351,13 @@ Matter samples
		* Updated all Matter samples that support low-power mode to enable the :ref:`lib_ram_pwrdn` feature.

mcuboot: Make ED25519 signature default for nrf54l series #19148

Are you sure you want to change the base?

mcuboot: Make ED25519 signature default for nrf54l series #19148

Conversation

de-nordic commented Nov 28, 2024

NordicBuilder commented Nov 28, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Nov 28, 2024

de-nordic commented Nov 28, 2024

LuDuda commented Nov 28, 2024

MarekPieta left a comment

Choose a reason for hiding this comment

maciejbaczmanski left a comment

Choose a reason for hiding this comment

de-nordic commented Dec 3, 2024

maciejbaczmanski Dec 3, 2024

Choose a reason for hiding this comment

maciejbaczmanski commented Dec 3, 2024

de-nordic commented Dec 3, 2024

ktaborowski commented Dec 4, 2024

NordicBuilder commented Dec 4, 2024 • edited Loading

shanthanordic commented Dec 4, 2024

gchwier commented Dec 5, 2024

nordicjm left a comment

Choose a reason for hiding this comment

de-nordic commented Dec 19, 2024

NordicBuilder commented Nov 28, 2024 •

edited

Loading

NordicBuilder commented Dec 4, 2024 •

edited

Loading