Blog

Compare diagnostic and release builds by the behavior each configuration difference changes, not by their labels. A logging-only difference, an authorization-policy difference and a fault-hardening difference need different evidence. Passing the same ordinary bad-signature test does not establish that two binaries retain the same hardening. This guide pins MCUboot v2.2.0’s Zephyr fault-injection-hardening profiles as a…

Choose the signing boundary from who may change calibration, when it may change and which firmware interprets it. Embedding calibration in a signed firmware image couples every permitted adjustment to that image’s release process. A separate record can support independent service, but its consumer must enforce authorization, applicability and semantic limits. This article provides an…

Treat a previous verification result as stale whenever its assumed image, trust policy or protected state can change without invalidating that result. First establish that the implementation actually reuses approval. A marker that says “checked before” is different from fresh authentication of the current bytes. This guide examines a concrete optional mechanism: MCUboot v2.2.0’s Zephyr…

Match a direct-XIP image’s placement metadata to the exact slot-offset convention used by the deployed MCUboot port. Then qualify executable correctness and authentication separately. A valid signature cannot repair a slot-specific image installed at the wrong execution location. This guide pins MCUboot v2.2.0’s direct-XIP loader and image-tool header generation. It is a placement review, not…

Read both slot trailers, decode their semantic states and apply the selected mode’s rules in order before calling a revert an image failure. An unconfirmed trial can request a revert even when its executable bytes are valid. Conversely, a swap request is not proof that the candidate will pass validation. This guide pins MCUboot v2.2.0,…

Accept a trusted-key hash provider only when its success result guarantees the correct image identity, a valid output length and fully initialized output bytes. A zero return code cannot substitute for those obligations. The provider is part of the authentication boundary, even when its implementation is small. This guide pins MCUboot v2.2.0’s MCUBOOT_HW_KEY callback interface…

Gate release on the public identities accepted by the shipping verifier, then prove that an otherwise valid development-signed image is rejected. A production signing job can use the intended key while an independently built bootloader still contains development trust. This guide pins MCUboot v2.2.0’s Zephyr compiled-public-key integration. Hardware-key and built-in-key interfaces require their own trust-source…