2021 08 10 TSC

MCUboot TSC 2021-08-10

Attendees:

• Brendan Moran
• David Brown
• Roman O
• Dominik (de-nordic)
• Hannes Tschofenig
• Almir Okato
• Garrett LoVerde
• Michel Jaouen

Agenda

• Agenda bashing
• Golioth intro (Garrett)
• GHSA-gcxh-546h-phg4
• 1.8 release
• SUIT Proposal (Brendan/Hannes)

Topics

• v1.8: Once we work through the existing pending pull requests, tag a v1.8.0-rc1.
• No objections to release GHSA with just an advisory and no code changes, while a github issue can track any code changes to remove private keys from the repo
• SUIT Proposal
  • Idea of preparsed manifests
  • To enable smoother transition to SUIT, propose making making MCUboot parse hard-coded manifests and continue with its current processing code. Two approaches
    • Cache this data in the download client, and store in the TLV, with pointers to the manifest for details.
      • Doesn't increase code size in MCUboot
      • download clients have extra functionality
      • Difficult for downloads done via serial recovery, or JTAG
    • Have a first step in MCUboot that parses a hard-coded manifest, placing in RAM (possibly in TLV form). Loader then does what it would normally do, but without needing to verify signatures.
  • Further discussion needed.