Scripts: Security enablement during west build #87669

Aasimshaik11 · 2025-03-26T09:45:22Z

Added changes to automate the signing of zephyr security using customtool during the west build process.

github-actions · 2025-03-26T09:45:54Z

Hello @Aasimshaik11, and thank you very much for your first pull request to the Zephyr project!
Our Continuous Integration pipeline will execute a series of checks on your Pull Request commit messages and code, and you are expected to address any failures by updating the PR. Please take a look at our commit message guidelines to find out how to format your commit messages, and at our contribution workflow to understand how to update your Pull Request. If you haven't already, please make sure to review the project's Contributor Expectations and update (by amending and force-pushing the commits) your pull request if necessary.
If you are stuck or need help please join us on Discord and ask your question there. Additionally, you can escalate the review when applicable. 😊

CMakeLists.txt

boards/silabs/radio_boards/siwx917_rb4338a/Kconfig.siwx917_rb4338a

boards/silabs/radio_boards/siwx917_rb4338a/board.cmake

scripts/west_commands/sign.py

boards/silabs/radio_boards/siwx917_rb4338a/board.cmake

scripts/west_commands/sign.py

soc/silabs/silabs_siwx91x/Kconfig.soc

soc/silabs/silabs_siwx91x/CMakeLists.txt

scripts/west_commands/sign.py

pdgendt · 2025-04-09T09:47:38Z

Please, do not resolve comments as per the contribution guidelines.

soc/silabs/silabs_siwx91x/Kconfig.soc

scripts/west_commands/sign.py

soc/silabs/silabs_siwx91x/CMakeLists.txt

scripts/west_commands/sign.py

pdgendt · 2025-04-14T07:57:20Z

soc/silabs/silabs_siwx91x/Kconfig.defconfig

+if SILABS_COMMANDER_SIGN
+config M4_OTA_KEY
+	string "M4 OTA Key for Commander"
+	default "Full_OTA_KEY_in_HEX"
+	help
+	The OTA key (hex string) used for signing and encryption with Silicon Labs Commander.
+
+config M4_PRIVATE_KEY
+	string "M4 Private Key Path for Commander"
+	default "Full_path_to_m4_private_key.pem"
+	help
+	Path to the private key file used for signing with Silicon Labs Commander, relative to the board directory.
+
+config COMMANDER_PATH
+	string "Path to Silicon Labs Commander executable"
+	default "Full_path_to_SimplicityCommander-Linux/commander/commander"
+	help
+	Path to the Silicon Labs Commander executable, used for signing the firmware binary.
+endif


These defaults do not make much sense IMO, if they are required, leave them as blank and throw an error during the build process.

Also help text needs to be indented with an additional 2 spaces after the tab.

jerome-pouiller

Could you split your commit in two parts:

Add support for west sign -r silabs_commander
Add support for west build -t signed-rps

scripts/west_commands/sign.py

soc/silabs/silabs_siwx91x/Kconfig.defconfig

scripts/west_commands/sign.py

jerome-pouiller · 2025-04-18T12:21:02Z

soc/silabs/silabs_siwx91x/CMakeLists.txt

+    )
+
+    # Add custom target to ensure signing is part of the build
+    add_custom_target(silabs_rps_sign_target


This is the user facing name. Don't we have a better name? signed-rps?

BTW, what is the purpose of this target? The user can already run west sign. Why do we provide west build -t silabs_rps_sign_target?

It would be more useful if the signing process was included in the default build.

Please, let the reviewer resolve the comments.

It would be more useful if the signing process was included in the default build.

soc/silabs/silabs_siwx91x/Kconfig.defconfig

jerome-pouiller · 2025-04-22T08:38:41Z

scripts/west_commands/sign.py

+   west sign -t silabs_commander -- --mic YOUR_OTA_KEY --encrypt YOUR_OTA_KEY --sign YOUR_PRIVATE_KEY.pem
+   or west sign -t silabs_commander
+
+For this to work, SILABS Commander tool must be installed in your PATH.


Silicon Labs (or possibly Silabs)

jerome-pouiller · 2025-04-22T08:41:57Z

scripts/west_commands/sign.py

+                        if line.strip().startswith('CONFIG_M4_OTA_KEY='):
+                            m4_ota_key = line.split('=')[1].strip().strip('"')
+                        elif line.strip().startswith('CONFIG_M4_PRIVATE_KEY='):
+                            m4_private_key = line.split('=')[1].strip().strip('"')


Do you need this at all? Can't you use:

build_conf.get('CONFIG_M4_OTA_KEY') build_conf.get('CONFIG_M4_PRIVATE_KEY')

No need , I added the fallback initially to cover potential retrieval issues. Now using .get() will resolve them.

jerome-pouiller · 2025-04-22T08:49:33Z

scripts/west_commands/sign.py

+                for path in default_paths:
+                    if os.path.isfile(path):
+                        commander_path = path
+                        break


KISS.

The system already manage that for you. (/usr/bin and /usr/bin/local are already part of the default PATH. If they are not, it is not your job to fix it).

jerome-pouiller · 2025-04-22T08:52:21Z

scripts/west_commands/sign.py

+        if not m4_private_key:
+            command.die("M4_PRIVATE_KEY not provided via --m4-private-key or set in prj.conf. Please specify --m4-private-key=/path/to/key or add CONFIG_M4_PRIVATE_KEY in prj.conf.")
+        if not commander_path:
+            command.die("Commander not found automatically. Please provide --commander-path=/path/to/commander or install it in your PATH.")


west sign already has the --tool-path option. Please use it:

def find_commandertool(cmd, args): if args.tool_path: commandertool = args.tool_path if not os.path.isfile(commandertool): cmd.die(f'--tool-path {commandertool}: no such file') else: commandertool = shutil.which('commander') if not commandertool: cmd.die('commander not found') return commandertool

I am not able to find find_commandertool in sign.py.

I meant, you can write a such function.

jerome-pouiller · 2025-04-22T08:57:18Z

scripts/west_commands/sign.py

+            command.die("ZEPHYR_BASE environment variable not set. Ensure you are running within a Zephyr build environment.")
+        workspace_base = pathlib.Path(zephyr_base)
+        if not workspace_base.is_dir():
+            command.die(f"Invalid ZEPHYR_BASE directory: {workspace_base}. Please check your Zephyr setup.")


I am not a specialist of the west commands, but I believe you should use zephyr_ext_common to retrieve ZEPHYR_BASE.

jerome-pouiller · 2025-04-22T09:05:49Z

scripts/west_commands/sign.py

+        kernel_name = build_conf.get('CONFIG_KERNEL_BIN_NAME', 'zephyr')
+
+        # Input and output files (using BUILD_DIR)
+        in_bin = b / 'zephyr' / f"{kernel_name}.bin.rps"  # Raw binary input


The name in_bin, the comment Raw binary input and the error messages No unsigned .bin found are confusing.
In fact, the input is not a binary file. It is a .rps file.

jerome-pouiller · 2025-04-22T09:10:14Z

soc/silabs/silabs_siwx91x/CMakeLists.txt

 add_subdirectory(siwg917)
+zephyr_include_directories(.)
+zephyr_sources_ifdef(CONFIG_SOC_SERIES_SIWG917 soc.c)
+zephyr_sources_ifdef(CONFIG_WISECONNECT_NETWORK_STACK nwp_init.c)


Redundant with soc/silabs/silabs_siwx91x/siwg917/CMakeLists.txt. BTW, nwp_init.c has been replaced by nwp.c a few weeks ago.

jerome-pouiller · 2025-04-22T09:12:16Z

soc/silabs/silabs_siwx91x/CMakeLists.txt

+
+# Custom signing with Silicon Labs Commander
+if(CONFIG_SiWX91X_SILABS_COMMANDER_SIGN)
+    # Define input and output files


Which input files? Outdated comments are worse than no comments.

jerome-pouiller · 2025-04-22T09:16:22Z

soc/silabs/silabs_siwx91x/CMakeLists.txt

+# Custom signing with Silicon Labs Commander
+if(CONFIG_SiWX91X_SILABS_COMMANDER_SIGN)
+    # Define input and output files
+    set(SIGNED_RPS ${PROJECT_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}.bin.rps)


Do you need absolute path? I believe you need it only because you change WORKING_DIRECTORY below. You can probably remove remove all this complexity.

jerome-pouiller · 2025-04-22T09:18:18Z

soc/silabs/silabs_siwx91x/CMakeLists.txt

+    )
+
+    # Add custom target to ensure signing is part of the build
+    add_custom_target(silabs_rps_sign_target


Please, let the reviewer resolve the comments.

It would be more useful if the signing process was included in the default build.

Added changes to automate the signing of zephyr security using customtool during the west build process. Signed-off-by: Aasim Shaik <[email protected]>

Aasimshaik11 force-pushed the zephyr-boot-security branch 2 times, most recently from 7541fb9 to 7052317 Compare March 26, 2025 11:28

Aasimshaik11 force-pushed the zephyr-boot-security branch from 7052317 to da52b68 Compare April 4, 2025 06:46

jerome-pouiller self-requested a review April 4, 2025 09:55

asmellby requested changes Apr 4, 2025

View reviewed changes

Aasimshaik11 force-pushed the zephyr-boot-security branch 4 times, most recently from 726af6b to b9ddd52 Compare April 8, 2025 10:31

Aasimshaik11 marked this pull request as ready for review April 9, 2025 04:34

github-actions bot added platform: Silabs Silicon Labs area: West West utility labels Apr 9, 2025

github-actions bot requested review from carlescufi, jhedberg, Martinhoff-maker, pdgendt and swinslow April 9, 2025 04:35

github-actions bot assigned pdgendt Apr 9, 2025

pdgendt requested changes Apr 9, 2025

View reviewed changes

Aasimshaik11 force-pushed the zephyr-boot-security branch 2 times, most recently from 6015f25 to d329322 Compare April 9, 2025 09:35

Aasimshaik11 force-pushed the zephyr-boot-security branch 2 times, most recently from 82ac254 to 2a2c05b Compare April 9, 2025 11:29

jhedberg reviewed Apr 9, 2025

View reviewed changes

soc/silabs/silabs_siwx91x/Kconfig.soc Outdated Show resolved Hide resolved

soc/silabs/silabs_siwx91x/Kconfig.soc Outdated Show resolved Hide resolved

jerome-pouiller reviewed Apr 9, 2025

View reviewed changes

soc/silabs/silabs_siwx91x/Kconfig.soc Outdated Show resolved Hide resolved

jerome-pouiller reviewed Apr 9, 2025

View reviewed changes

scripts/west_commands/sign.py Outdated Show resolved Hide resolved

jerome-pouiller reviewed Apr 9, 2025

View reviewed changes

scripts/west_commands/sign.py Outdated Show resolved Hide resolved

jerome-pouiller requested changes Apr 9, 2025

View reviewed changes

jerome-pouiller self-requested a review April 10, 2025 10:13

Aasimshaik11 force-pushed the zephyr-boot-security branch 5 times, most recently from 3672549 to 8dc4f06 Compare April 14, 2025 07:35

pdgendt reviewed Apr 14, 2025

View reviewed changes

Aasimshaik11 force-pushed the zephyr-boot-security branch 5 times, most recently from 46bdfdf to c6cbbf6 Compare April 18, 2025 06:20

jerome-pouiller reviewed Apr 18, 2025

View reviewed changes

soc/silabs/silabs_siwx91x/Kconfig.defconfig Outdated Show resolved Hide resolved

Aasimshaik11 force-pushed the zephyr-boot-security branch from c6cbbf6 to f9c082c Compare April 20, 2025 08:14

github-actions bot added the area: Samples Samples label Apr 20, 2025

github-actions bot requested review from kartben and nashif April 20, 2025 08:14

Aasimshaik11 force-pushed the zephyr-boot-security branch 3 times, most recently from 2ac309f to 009ada8 Compare April 21, 2025 05:42

jerome-pouiller requested changes Apr 22, 2025

View reviewed changes

Aasimshaik11 force-pushed the zephyr-boot-security branch 2 times, most recently from 7123a51 to 964683e Compare April 23, 2025 18:22

Scripts: Security enablement during west build

82595cd

Added changes to automate the signing of zephyr security using customtool during the west build process. Signed-off-by: Aasim Shaik <[email protected]>

Aasimshaik11 force-pushed the zephyr-boot-security branch from 964683e to 82595cd Compare April 25, 2025 05:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Scripts: Security enablement during west build #87669

Scripts: Security enablement during west build #87669

Aasimshaik11 commented Mar 26, 2025

github-actions bot commented Mar 26, 2025

pdgendt commented Apr 9, 2025

pdgendt Apr 14, 2025 •

edited

Loading

jerome-pouiller left a comment

jerome-pouiller Apr 18, 2025

jerome-pouiller Apr 18, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

Aasimshaik11 Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

Aasimshaik11 Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

jerome-pouiller Apr 22, 2025

Scripts: Security enablement during west build #87669

Are you sure you want to change the base?

Scripts: Security enablement during west build #87669

Conversation

Aasimshaik11 commented Mar 26, 2025

github-actions bot commented Mar 26, 2025

pdgendt commented Apr 9, 2025

pdgendt Apr 14, 2025 • edited Loading

Choose a reason for hiding this comment

jerome-pouiller left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pdgendt Apr 14, 2025 •

edited

Loading