suit: Build system changes needed for encryption #19681

ahasztag · 2024-12-20T11:43:57Z

This commit contains changes to the SUIT build system allowing for encrypting images for update.

NordicBuilder · 2024-12-20T11:45:05Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
suit-generator	nrfconnect/suit-generator@`f07d308`	nrfconnect/suit-generator@`f26d3e0` (`ncs`)	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-12-20T11:48:52Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 21

Inputs:

Sources:

sdk-nrf: PR head: a56204b98b73062d988d17be31c8e94fd2960a78
suit-generator: PR head: f26d3e0295fd9fa73c3fc2ea7f70a3d96e36a44e

more details

sdk-nrf:

PR head: a56204b98b73062d988d17be31c8e94fd2960a78
merge base: 658662845a8e4d4cb677800c8d36acfac9176c90
target head (main): aec6383d2d31332319493bab8b5364d62f0fad8a
Diff

suit-generator:

PR head: f26d3e0295fd9fa73c3fc2ea7f70a3d96e36a44e
merge base: f07d308f03e039bc73767c145f4cff4a70e74442
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (13)

cmake
│  ├── sysbuild
│  │  ├── suit.cmake
│  │  │ suit_utilities.cmake
config
│  ├── suit
│  │  ├── templates
│  │  │  ├── nrf54h20
│  │  │  │  ├── default
│  │  │  │  │  ├── v1
│  │  │  │  │  │  ├── app_envelope.yaml.jinja2
│  │  │  │  │  │  │ rad_envelope.yaml.jinja2
modules
│  ├── lib
│  │  ├── suit-generator
│  │  │  ├── ncs
│  │  │  │  ├── Kconfig
│  │  │  │  ├── app_envelope_encrypted.yaml.jinja2
│  │  │  │  ├── basic_kms.py
│  │  │  │  ├── build.py
│  │  │  │  │ encrypt_script.py
samples
│  ├── suit
│  │  ├── smp_transfer
│  │  │  ├── suit
│  │  │  │  ├── nrf54h20
│  │  │  │  │  ├── app_envelope_extflash.yaml.jinja2
│  │  │  │  │  │ rad_envelope_extflash.yaml.jinja2
sysbuild
│  │ Kconfig.suit
west.yml

Outputs:

Toolchain

Version: 11349092be
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:11349092be_912848a074

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 20
✅ Integration tests
- ✅ test-sdk-audio - Skipped: Job was skipped as it succeeded in a previous run
- ✅ desktop52_verification - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-boot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-apps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test_ble_nrf_config - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_mesh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-chip - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nfc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_libmodem-nrf - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_serial_lte_modem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ doc-internal - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_thingy91 - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf_crypto - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rpc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rs - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-fem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-tfm - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-thread - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-zigbee - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-find-my - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_mosh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_positioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-sidewalk - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-wifi - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-low-level - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_nrf_provisioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-pmic-samples
- ✅ test-sdk-mcuboot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-dfu - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-secdom-samples-public - Skipped: Job was skipped as it succeeded in a previous run
- ⚠️ test-sdk-dfu

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-12-20T12:01:14Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

NordicBuilder · 2024-12-20T13:01:52Z

Memory footprint analysis revealed the following potential issues

sample.matter.template.debug[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 911938[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)
sample.matter.template.release[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 820770[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)

Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-19681/19)

nordicjm

apply changes throughout whole PR

nordicjm · 2024-12-23T07:55:23Z

cmake/sysbuild/suit.cmake

+        -----------------------------------------------------------
+        --- WARNING: Using default file-based basic KMS implentation for encryption.  ---


the widths should match for the header and footer with the message

nordicjm · 2024-12-23T07:55:29Z

cmake/sysbuild/suit.cmake

+        message(WARNING "
+        -----------------------------------------------------------
+        --- WARNING: Using default file-based basic KMS implentation for encryption.  ---
+        --- It should not be used for production unless the build is performed in     ---


typos need fixing

sysbuild/Kconfig.suit

nordicjm · 2024-12-23T07:56:47Z

sysbuild/Kconfig.suit

+	  Python script called to generate encryption artifacts for images inside a SUIT envelope.
+	  See the help message for the default encryption script to see what arguments the script
+	  must accept.
+	default "${ZEPHYR_NRF_MODULE_DIR}/../modules/lib/suit-generator/ncs/encrypt_script.py" if SUIT_ENVELOPE_ENCRYPT_SCRIPT_DEFAULT


use the actual module name instead of a path from the nrf module?

Ok, changed

sysbuild/Kconfig.suit

nordicjm · 2025-01-07T07:22:27Z

sysbuild/Kconfig.suit

+choice SUIT_ENVELOPE_KMS_SCRIPT
+	prompt "Select the used SUIT KMS script to be used by the encryption script"
+	help
+	   This is the "internal" python script that is called by the encryption script to perform the cryptographic operations,


1x tab followed by 2x spaces for help text indent

nordicjm · 2025-01-07T07:23:00Z

sysbuild/Kconfig.suit

+
+config SUIT_ENVELOPE_KMS_SCRIPT_PATH
+	string "Location of SUIT KMS script"
+	default "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs/basic_kms.py" if SUIT_ENVELOPE_KMS_SCRIPT_BASIC


why is this a kconfig?

The SUIT_ENVELOPE_KMS_SCRIPT choice is supposed to be extended, adding more possible values to SUIT_ENVELOPE_KMS_SCRIPT_PATH - in a similar way like

sdk-nrf/sysbuild/Kconfig.netcore

Line 142 in cac49ac

default "${ZEPHYR_NRF_MODULE_DIR}/samples/nrf5340/empty_net_core" if NETCORE_EMPTY

The netcore part is used to specify an image, not a file, the file part of signing is done like so: https://github.com/zephyrproject-rtos/zephyr/blob/main/CMakeLists.txt#L2027 which then uses this file by default: https://github.com/zephyrproject-rtos/zephyr/blob/main/cmake/mcuboot.cmake but in ncs is overridden here: https://github.com/nrfconnect/sdk-nrf/blob/main/sysbuild/CMakeLists.txt#L293 or https://github.com/nrfconnect/sdk-nrf/blob/main/sysbuild/CMakeLists.txt#L336

Ok, the misunderstanding was cleared offline, I will fix this.

nordicjm

Nit. can be fixed in future

cmake/sysbuild/suit_utilities.cmake

This commit contains changes to the SUIT build system allowing for encrypting images for update. Signed-off-by: Artur Hadasz <[email protected]>

ahasztag requested review from SylwesterKonczyk, adsz-nordic, kszromek-nordic, nordic-mik7, robertstypa and tomchy December 20, 2024 11:43

ahasztag requested a review from a team as a code owner December 20, 2024 11:43

ahasztag requested a review from a team December 20, 2024 11:43

ahasztag requested a review from a team as a code owner December 20, 2024 11:43

github-actions bot added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Dec 20, 2024

NordicBuilder added manifest-suit-generator DNM labels Dec 20, 2024

nordicjm requested changes Dec 23, 2024

View reviewed changes

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 3 times, most recently from 0fcaa3b to b40b0a3 Compare December 27, 2024 14:24

tomchy reviewed Jan 2, 2025

View reviewed changes

sysbuild/Kconfig.suit Outdated Show resolved Hide resolved

adsz-nordic approved these changes Jan 3, 2025

View reviewed changes

tomchy approved these changes Jan 3, 2025

View reviewed changes

nordicjm reviewed Jan 7, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 4 times, most recently from e5c4dd9 to 97a7f9e Compare January 7, 2025 14:41

ahasztag requested a review from nordicjm January 8, 2025 09:34

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 2 times, most recently from 2c5fdd4 to 36e9c11 Compare January 8, 2025 13:47

nordicjm approved these changes Jan 9, 2025

View reviewed changes

cmake/sysbuild/suit_utilities.cmake Outdated Show resolved Hide resolved

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from 36e9c11 to 5677cb8 Compare January 9, 2025 08:15

NordicBuilder removed the DNM label Jan 9, 2025

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 2 times, most recently from dad9fb9 to 011a835 Compare January 9, 2025 08:22

robertstypa approved these changes Jan 10, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from 011a835 to 91e4de6 Compare January 10, 2025 14:05

suit: Build system changes needed for encryption

a56204b

This commit contains changes to the SUIT build system allowing for encrypting images for update. Signed-off-by: Artur Hadasz <[email protected]>

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from 91e4de6 to a56204b Compare January 13, 2025 08:08

tomchy merged commit 4cf924e into nrfconnect:main Jan 13, 2025
13 checks passed

ahasztag mentioned this pull request Jan 24, 2025

suit: nRF9280 SUIT support #18496

Merged

ahasztag deleted the NCSDK-30935_encrypt_script_build_system branch February 21, 2025 10:36

		-----------------------------------------------------------
		--- WARNING: Using default file-based basic KMS implentation for encryption. ---

suit: Build system changes needed for encryption #19681

suit: Build system changes needed for encryption #19681

Uh oh!

Conversation

ahasztag commented Dec 20, 2024

Uh oh!

NordicBuilder commented Dec 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Dec 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

NordicBuilder commented Dec 20, 2024

Uh oh!

NordicBuilder commented Dec 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Memory footprint analysis revealed the following potential issues

Uh oh!

nordicjm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nordicjm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024 •

edited

Loading