scripts: Update ncs-provision west command to use nrfutil for uploading keys

[fundakol]

nrfutil provides a command to upload public keys to KMU. This PR replaces nrfprovision script with nrfutil in west ncs-provision command .

Example usage:

west ncs-provision upload --soc nrf54l15 --key ./bootloader/mcuboot/root-ed25519.pem --dev-id 1057748769

Additional options:

• --dry-run - generate JSON keyfile without executing upload
• --build-dir=Path - path where keyfile will be saved
• --input=Path - path to a YAML file with list of keys to upload, example:

  - keyname: UROT_PUBKEY
    keys: ["private_key1.pem"]
    policy: lock
  - keyname: APP_PUBKEY
    keys: ["private_key2.pem"]
    policy: lock

[NordicBuilder]

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 27

Inputs:

Sources:

sdk-nrf: PR head: fcc8e9c641def43187e930dcda8db5e897bdcb81

more details

sdk-nrf:

PR head: fcc8e9c641def43187e930dcda8db5e897bdcb81
merge base: 166df0fa0a75a121e415dafa00501c8d155740d9
target head (main): 96683e2782923209e3f4bb9e6e0b48db770afee7
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (6)

CODEOWNERS
scripts
│  ├── requirements-extra.txt
│  ├── requirements-fixed.txt
│  ├── west-commands.yml
│  ├── west_commands
│  │  ├── ncs-provision.py
│  │  │ ncs_provision.py

Outputs:

Toolchain

Version: aedb4c0245
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:aedb4c0245_bece0367df

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

• ◻️ Toolchain - Skipped: existing toolchain is used
• ✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 26
• ✅ Integration tests
  • ✅ test-fw-nrfconnect-boot - Skipped: Job was skipped as it succeeded in a previous run
  • ✅ test-sdk-mcuboot

Disabled integration tests

• • desktop52_verification
  • doc-internal
  • test_ble_nrf_config
  • test-fw-nrfconnect-apps
  • test-fw-nrfconnect-ble_mesh
  • test-fw-nrfconnect-ble_samples
  • test-fw-nrfconnect-chip
  • test-fw-nrfconnect-fem
  • test-fw-nrfconnect-nfc
  • test-fw-nrfconnect-nrf-iot_cloud
  • test-fw-nrfconnect-nrf-iot_lwm2m
  • test-fw-nrfconnect-nrf-iot_mosh
  • test-fw-nrfconnect-nrf-iot_positioning
  • test-fw-nrfconnect-nrf-iot_samples
  • test-fw-nrfconnect-nrf-iot_serial_lte_modem
  • test-fw-nrfconnect-nrf-iot_thingy91
  • test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
  • test-fw-nrfconnect-nrf_crypto
  • test-fw-nrfconnect-proprietary_esb
  • test-fw-nrfconnect-ps
  • test-fw-nrfconnect-rpc
  • test-fw-nrfconnect-rs
  • test-fw-nrfconnect-tfm
  • test-fw-nrfconnect-thread
  • test-fw-nrfconnect-zigbee
  • test-low-level
  • test-sdk-audio
  • test-sdk-dfu
  • test-sdk-find-my
  • test-sdk-pmic-samples
  • test-sdk-sidewalk
  • test-sdk-wifi
  • test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

[gchwier]

I've run our internal tests on that PR and surprisingly all tests passed.
Version of nrfutil device on the CI is 2.7.8 (I thought that in 2.7.13 KMU keys provissioning was added to nrfutil).
I've checked it locally, and it is working also on nrfutil 2.7.8

nrfutil install --force device=2.7.8
nrfutil device x-provision-nrf54l-keys --key-file /tmp/nrfutil_22pv6_t3/keyfile.json --verify --serial-number xxx

to run with Twister:

$ZEPHYR_BASE/scripts/twister -T tests/subsys/kmu/hello_for_kmu --device-testing --hardware-map hardware_map.yml --west-flash=--recover -vv --no-clean -s mcuboot.kmu.west.provision.default_key --pytest-args='-k test_kmu_use_key_from_config'

where command:

west ncs-provision upload --soc nrf54l15 --key /home/grch/ncs/bootloader/mcuboot/root-ed25519.pem --dev-id 001057755847

is called to provision KMU keys.

Scripts looks OK, and if nrfutil supports KMU keys provisioning in 2.7.8 version, it can be integrated (should not fail any regression tests)

Dependency to nrfprovision package can be removed from requirements-extra.txt and from kmu_provision.rst:
https://github.com/nrfconnect/sdk-nrf/blob/main/doc/nrf/app_dev/device_guides/nrf54l/kmu_provision.rst#L20

[gchwier]

remember about removing dependencies to nrfprovision package from requirements-extra.txt and updating docs kmu_provision.rst

[nvlsianpu]

rebase needed