Configuring custom bootloader signature key with sysbuild

[or-rhssk]

Assuming the following workspace structure:

workspace
├── bootloader
│   └── mcuboot
├── application
│   ├── app
│   │   ├── sign-ed25519.pem
│   │   ├── sysbuild.conf

what would be the correct way to specify sign-ed25519.pem to both MCUboot and application without hardcoding the absolute path of workspace directory?

CONFIG_MCUBOOT_SIGNATURE_KEY_FILE and CONFIG_BOOT_SIGNATURE_KEY_FILE both get their value from SB_CONFIG_BOOT_SIGNATURE_KEY_FILE which causes an issue when relative paths are used:

• CONFIG_BOOT_SIGNATURE_KEY_FILE is relative to mcuboot directory,
• CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is relative to workspace directory.

Zephyr samples are not affected by this since they use the default SB_CONFIG_BOOT_SIGNATURE_KEY_FILE value, which expands to an absolute path:

zephyr/share/sysbuild/bootloader/Kconfig

Lines 58 to 65 in 65c9058

	config BOOT_SIGNATURE_KEY_FILE
	string "PEM key file"
	default "$(ZEPHYR_MCUBOOT_MODULE_DIR)/root-ec-p256.pem" if BOOT_SIGNATURE_TYPE_ECDSA_P256
	default "$(ZEPHYR_MCUBOOT_MODULE_DIR)/root-ed25519.pem" if BOOT_SIGNATURE_TYPE_ED25519
	default "$(ZEPHYR_MCUBOOT_MODULE_DIR)/root-rsa-2048.pem" if BOOT_SIGNATURE_TYPE_RSA
	default ""
	help
	Absolute path to key file to use with MCUBoot.

However, in the workspace above I'd like to use a relative path or some other mechanism that expands to absolute path during the build process.

[or-rhssk]

It looks like since 65c9058 it's possible to specify the ED25519 key from command line:

west build -b reel_board --sysbuild app -- -DSB_CONFIG_BOOT_SIGNATURE_KEY_FILE=\"$(pwd)/app/sign-ed25519.pem\" -DSB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

It would be nice to be able to do this in sysbuild.conf though.

[nordicjm]

This works fine in sysbuild in a sysbuild.cmake file: set(SB_CONFIG_BOOT_SIGNATURE_KEY_FILE "${CMAKE_CURRENT_LIST_DIR}/my_key.pem")

[or-rhssk]

That appears to only change application key, bootloader remains at default value.

On latest main, with the suggested changes:

> git status
On branch main
Your branch is up to date with 'origin/main'.

Untracked files:
  (use "git add <file>..." to include in what will be committed)
	samples/application_development/sysbuild/with_mcuboot/my_key.pem
	samples/application_development/sysbuild/with_mcuboot/sysbuild.cmake

> west build -b reel_board --sysbuild samples/application_development/sysbuild/with_mcuboot
...
MCUBoot bootloader key file: /home/user/workspace/bootloader/mcuboot/root-rsa-2048.pem
...

> rg "BOOT_SIGNATURE_KEY_FILE" build/**/.config
build/zephyr/.config
30:SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="/home/user/workspace/bootloader/mcuboot/root-rsa-2048.pem"

build/with_mcuboot/zephyr/.config
404:CONFIG_MCUBOOT_SIGNATURE_KEY_FILE="/home/user/workspace/zephyr/samples/application_development/sysbuild/with_mcuboot/my_key.pem"

build/mcuboot/zephyr/.config
17:CONFIG_BOOT_SIGNATURE_KEY_FILE="/home/user/workspace/bootloader/mcuboot/root-rsa-2048.pem"

[nordicjm]

String substitution works when using a sysbuild.conf file e.g. SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="${APP_DIR}/my_key.pem"

[or-rhssk]

That seems to do the trick, thanks!