Is your firmware signed with MCUboot's public key?

When you build with sysbuild and MCUboot and change nothing, your images are signed with a key whose private half anyone can download. The bootloader then accepts firmware signed by anyone. It is meant for development, and it is easy to ship by accident.

Why it happens

MCUboot verifies the signature of every image before it boots it. To make the first build work, Zephyr points SB_CONFIG_BOOT_SIGNATURE_KEY_FILE at a key from the MCUboot repository, root-ec-p256.pem or one of its siblings for other algorithms. The build prints a warning, and the warning scrolls away.

Checking an image

A signed image carries the hash of the public key it was signed with (the KEYHASH TLV). Drop zephyr.signed.bin on the MCUboot image inspector: it compares that hash with the keys published in the MCUboot repository, checks the image hash, and shows the version and every TLV. With imgtool:

imgtool dumpinfo build/zephyr/zephyr.signed.bin

and compare the KEYHASH with the SHA-256 of your own public key.

Using your own key

imgtool keygen -k my-signing-key.pem -t ecdsa-p256

Keep the file out of the repository and back it up: every device you ship accepts only images signed with it, for as long as its bootloader is the one you flash now. Then, in sysbuild.conf:

SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="/secure/path/my-signing-key.pem"

The bootloader is built with the public half, and every image after it is signed with the private one. Devices already shipped with the development key cannot be moved to the new key by an update alone: their bootloader only trusts the old key.

The other half: getting images to devices

A signed image still has to reach devices behind NAT and firewalls. Pinscope's Zephyr module takes zephyr.signed.bin from the dashboard to the device, lets MCUboot test it, and confirms it only when the new firmware is back online.

Try it

Three devices are free, and no card is needed. Create an account, or read the guide for your platform: ESP32, Zephyr, Raspberry Pi Pico, Linux, ESP8266.