Skip to content

Update key makefile #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ineskhou merged 4 commits into from
Jan 30, 2026
+18 −14
Merged

Update key makefile #308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d75a66b
added Makefile edit
ineskhou Jan 29, 2026
7ecf643
Merge branch 'main' of github.com:Open-Source-Space-Foundation/proves…
ineskhou Jan 29, 2026
e6d6ec1
edit readme
ineskhou Jan 29, 2026
a0c1a03
Apply suggestion from @hrfarmer
ineskhou Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
.PHONY: all
all: submodules fprime-venv zephyr generate-if-needed build
all: submodules fprime-venv zephyr copy-keys generate-if-needed build

.PHONY: help
help: ## Display this help.
Expand Down Expand Up @@ -131,6 +131,10 @@ generate-auth-key: ## Generate AuthDefaultKey.h with a random HMAC key
fi
@echo "Generated $(AUTH_DEFAULT_KEY_HEADER)"

.PHONY: copy-keys
copy-keys:
Comment on lines +134 to +135
Copy link
Collaborator

@nateinaction nateinaction Jan 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you remove the PHONY declaration and name the target keys/proves.pem it will only run if that file doesn't exist. This means that you can set this target to run automatically during the build step and remove the readme guidance.

Suggested change
.PHONY: copy-keys
copy-keys:
keys/proves.pem:

@mkdir -p keys
@cp lib/zephyr-workspace/bootloader/mcuboot/root-rsa-2048.pem keys/proves.pem

SYSBUILD_PATH ?= $(shell pwd)/lib/zephyr-workspace/zephyr/samples/sysbuild/with_mcuboot
.PHONY: build-mcuboot
Expand Down
26 changes: 13 additions & 13 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,19 +62,6 @@ The bootloader build outputs `mcuboot.uf2` at the repo root Put the board into U
cp mcuboot.uf2 [path-to-your-board]
```

#### Copy the signing key used by the bootloader

MCUBoot only boots images that are **signed with the same key** the bootloader is configured for. This repo’s app build is configured to sign using `keys/proves.pem` (see `CONFIG_MCUBOOT_SIGNATURE_KEY_FILE` in `prj.conf`), so you must ensure that file matches the bootloader you flashed.

For the default (development) key bundled with MCUBoot:

```shell
mkdir -p keys
cp lib/zephyr-workspace/bootloader/mcuboot/root-rsa-2048.pem keys/proves.pem
```

If you regenerate/replace the bootloader (or switch computers and flash a bootloader built elsewhere), make sure you also update `keys/proves.pem` to the matching signing key, or your built images will not boot.

## Running the code

Run generate from the `proves-core-reference` directory. This generates the build cache for FPrime. You only need to do generate if something in the core FPrime package has changed
Expand Down Expand Up @@ -103,6 +90,19 @@ Finally, run the fprime-gds.
make gds
```

#### Ensuring your authentication/signing is correct

The Makefile will ensure the authentication is correct if you run the code on the same computer you flash on. However, if you switch from a computer that compiled the code you will likely have issues with authentication. Here are some things you may encounter

MCUBoot only boots images that are **signed with the same key** the bootloader is configured for. This repo’s app build is configured to sign using `keys/proves.pem` (see `CONFIG_MCUBOOT_SIGNATURE_KEY_FILE` in `prj.conf`), so you must ensure that file matches the bootloader you flashed.

If you regenerate/replace the bootloader (or switch computers and flash a bootloader built elsewhere), make sure you also update `keys/proves.pem` to the matching signing key, or your built images will not boot.

```shell
make copy-keys
```
You also want to make sure the authentication key the gds runs with is the same as the authentication key on the board. For that, you want to make sure the authentication key in FprimeZephyrReference/Components/Authenticate/AuthDefaultKey.h matches.

## Running Integration Tests

First, start GDS with:
Expand Down