suit: Build system changes needed for encryption #19681

ahasztag · 2024-12-20T11:43:57Z

This commit contains changes to the SUIT build system allowing for encrypting images for update.

NordicBuilder · 2024-12-20T11:45:05Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
suit-generator	nrfconnect/suit-generator@`f07d308`	nrfconnect/suit-generator@`f26d3e0` (`ncs`)	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-12-20T11:48:52Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 16

Inputs:

Sources:

sdk-nrf: PR head: 011a8354eeeafa1582ce7e7410f7d7934197359d
suit-generator: PR head: f26d3e0295fd9fa73c3fc2ea7f70a3d96e36a44e

more details

sdk-nrf:

PR head: 011a8354eeeafa1582ce7e7410f7d7934197359d
merge base: 852ae666c4c15cea69f5ee33529d3220f66c070e
target head (main): 9299b43e0891eb3d300f6139d1b8235f95ed8832
Diff

suit-generator:

PR head: f26d3e0295fd9fa73c3fc2ea7f70a3d96e36a44e
merge base: f07d308f03e039bc73767c145f4cff4a70e74442
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (13)

cmake
│  ├── sysbuild
│  │  ├── suit.cmake
│  │  │ suit_utilities.cmake
config
│  ├── suit
│  │  ├── templates
│  │  │  ├── nrf54h20
│  │  │  │  ├── default
│  │  │  │  │  ├── v1
│  │  │  │  │  │  ├── app_envelope.yaml.jinja2
│  │  │  │  │  │  │ rad_envelope.yaml.jinja2
modules
│  ├── lib
│  │  ├── suit-generator
│  │  │  ├── ncs
│  │  │  │  ├── Kconfig
│  │  │  │  ├── app_envelope_encrypted.yaml.jinja2
│  │  │  │  ├── basic_kms.py
│  │  │  │  ├── build.py
│  │  │  │  │ encrypt_script.py
samples
│  ├── suit
│  │  ├── smp_transfer
│  │  │  ├── suit
│  │  │  │  ├── nrf54h20
│  │  │  │  │  ├── app_envelope_extflash.yaml.jinja2
│  │  │  │  │  │ rad_envelope_extflash.yaml.jinja2
sysbuild
│  │ Kconfig.suit
west.yml

Outputs:

Toolchain

Version: b77d8c1312
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:b77d8c1312_912848a074

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 15
❌ Integration tests
- ✅ test-sdk-audio - Skipped: Job was skipped as it succeeded in a previous run
- ✅ desktop52_verification - Skipped: Job was skipped as it succeeded in a previous run
- ❌ test-fw-nrfconnect-boot
- ✅ test-fw-nrfconnect-apps - Skipped: Job was skipped as it succeeded in a previous run
- ❌ test_ble_nrf_config
- ✅ test-fw-nrfconnect-ble_mesh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-chip - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nfc - Skipped: Job was skipped as it succeeded in a previous run
- ❌ test-fw-nrfconnect-nrf-iot_libmodem-nrf
- ✅ test-fw-nrfconnect-nrf-iot_serial_lte_modem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ doc-internal - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_thingy91 - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf_crypto - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rpc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rs - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-fem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-tfm - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-thread - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-zigbee - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-find-my - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_mosh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_positioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-sidewalk - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-wifi - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-low-level - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_nrf_provisioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-pmic-samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-mcuboot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-dfu - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-secdom-samples-public - Skipped: Job was skipped as it succeeded in a previous run
- ⚠️ test-sdk-dfu

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-12-20T12:01:14Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

NordicBuilder · 2024-12-20T13:01:52Z

Memory footprint analysis revealed the following potential issues

sample.matter.template.debug[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 911938[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)
sample.matter.template.release[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 820770[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)

Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-19681/15)

nordicjm

apply changes throughout whole PR

nordicjm · 2024-12-23T07:55:23Z

cmake/sysbuild/suit.cmake

+        -----------------------------------------------------------
+        --- WARNING: Using default file-based basic KMS implentation for encryption.  ---


the widths should match for the header and footer with the message

nordicjm · 2024-12-23T07:55:29Z

cmake/sysbuild/suit.cmake

+        message(WARNING "
+        -----------------------------------------------------------
+        --- WARNING: Using default file-based basic KMS implentation for encryption.  ---
+        --- It should not be used for production unless the build is performed in     ---


typos need fixing

sysbuild/Kconfig.suit

nordicjm · 2024-12-23T07:56:47Z

sysbuild/Kconfig.suit

+	  Python script called to generate encryption artifacts for images inside a SUIT envelope.
+	  See the help message for the default encryption script to see what arguments the script
+	  must accept.
+	default "${ZEPHYR_NRF_MODULE_DIR}/../modules/lib/suit-generator/ncs/encrypt_script.py" if SUIT_ENVELOPE_ENCRYPT_SCRIPT_DEFAULT


use the actual module name instead of a path from the nrf module?

Ok, changed

sysbuild/Kconfig.suit

nordicjm · 2025-01-07T07:22:27Z

sysbuild/Kconfig.suit

+choice SUIT_ENVELOPE_KMS_SCRIPT
+	prompt "Select the used SUIT KMS script to be used by the encryption script"
+	help
+	   This is the "internal" python script that is called by the encryption script to perform the cryptographic operations,


1x tab followed by 2x spaces for help text indent

nordicjm · 2025-01-07T07:23:00Z

sysbuild/Kconfig.suit

+
+config SUIT_ENVELOPE_KMS_SCRIPT_PATH
+	string "Location of SUIT KMS script"
+	default "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs/basic_kms.py" if SUIT_ENVELOPE_KMS_SCRIPT_BASIC


why is this a kconfig?

The SUIT_ENVELOPE_KMS_SCRIPT choice is supposed to be extended, adding more possible values to SUIT_ENVELOPE_KMS_SCRIPT_PATH - in a similar way like

sdk-nrf/sysbuild/Kconfig.netcore

Line 142 in cac49ac

default "${ZEPHYR_NRF_MODULE_DIR}/samples/nrf5340/empty_net_core" if NETCORE_EMPTY

The netcore part is used to specify an image, not a file, the file part of signing is done like so: https://github.com/zephyrproject-rtos/zephyr/blob/main/CMakeLists.txt#L2027 which then uses this file by default: https://github.com/zephyrproject-rtos/zephyr/blob/main/cmake/mcuboot.cmake but in ncs is overridden here: https://github.com/nrfconnect/sdk-nrf/blob/main/sysbuild/CMakeLists.txt#L293 or https://github.com/nrfconnect/sdk-nrf/blob/main/sysbuild/CMakeLists.txt#L336

Ok, the misunderstanding was cleared offline, I will fix this.

nordicjm

Nit. can be fixed in future

cmake/sysbuild/suit_utilities.cmake

This commit contains changes to the SUIT build system allowing for encrypting images for update. Signed-off-by: Artur Hadasz <[email protected]>

ahasztag requested review from tomchy, SylwesterKonczyk, robertstypa, adsz-nordic, kszromek-nordic and nordic-mik7 December 20, 2024 11:43

ahasztag requested review from a team as code owners December 20, 2024 11:43

github-actions bot added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Dec 20, 2024

NordicBuilder added manifest-suit-generator DNM labels Dec 20, 2024

nordicjm requested changes Dec 23, 2024

View reviewed changes

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 3 times, most recently from 0fcaa3b to b40b0a3 Compare December 27, 2024 14:24

tomchy reviewed Jan 2, 2025

View reviewed changes

sysbuild/Kconfig.suit Show resolved Hide resolved

adsz-nordic approved these changes Jan 3, 2025

View reviewed changes

tomchy approved these changes Jan 3, 2025

View reviewed changes

nordicjm reviewed Jan 7, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 4 times, most recently from e5c4dd9 to 97a7f9e Compare January 7, 2025 14:41

ahasztag requested a review from nordicjm January 8, 2025 09:34

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch 2 times, most recently from 2c5fdd4 to 36e9c11 Compare January 8, 2025 13:47

nordicjm approved these changes Jan 9, 2025

View reviewed changes

cmake/sysbuild/suit_utilities.cmake Outdated Show resolved Hide resolved

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from 36e9c11 to 5677cb8 Compare January 9, 2025 08:15

NordicBuilder removed the DNM label Jan 9, 2025

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from 1717af4 to dad9fb9 Compare January 9, 2025 08:22

suit: Build system changes needed for encryption

011a835

This commit contains changes to the SUIT build system allowing for encrypting images for update. Signed-off-by: Artur Hadasz <[email protected]>

ahasztag force-pushed the NCSDK-30935_encrypt_script_build_system branch from dad9fb9 to 011a835 Compare January 9, 2025 08:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

suit: Build system changes needed for encryption #19681

suit: Build system changes needed for encryption #19681

ahasztag commented Dec 20, 2024

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024

NordicBuilder commented Dec 20, 2024 •

edited

Loading

nordicjm left a comment

nordicjm Dec 23, 2024

ahasztag Dec 27, 2024

nordicjm Dec 23, 2024

ahasztag Dec 27, 2024

nordicjm Dec 23, 2024

ahasztag Dec 27, 2024

nordicjm Jan 7, 2025

ahasztag Jan 7, 2025

nordicjm Jan 7, 2025

ahasztag Jan 7, 2025

nordicjm Jan 7, 2025

This comment was marked as resolved.

This comment was marked as resolved.

ahasztag Jan 7, 2025

ahasztag Jan 7, 2025

nordicjm left a comment

		-----------------------------------------------------------
		--- WARNING: Using default file-based basic KMS implentation for encryption. ---

suit: Build system changes needed for encryption #19681

Are you sure you want to change the base?

suit: Build system changes needed for encryption #19681

Conversation

ahasztag commented Dec 20, 2024

NordicBuilder commented Dec 20, 2024 • edited Loading

NordicBuilder commented Dec 20, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Dec 20, 2024

NordicBuilder commented Dec 20, 2024 • edited Loading

Memory footprint analysis revealed the following potential issues

nordicjm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

This comment was marked as resolved.

This comment was marked as resolved.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nordicjm left a comment

Choose a reason for hiding this comment

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024 •

edited

Loading

NordicBuilder commented Dec 20, 2024 •

edited

Loading