security-updates
Secure boot and firmware update workflows for Zephyr RTOS. Covers MCUboot integration, production image signing, DFU protocols (MCUmgr), fail-safe rollback mechanisms, and mbedTLS crypto basics. Trigger when implementing over-the-air (OTA) updates, securing the boot process, or managing cryptographic keys.
适合你，如果正在开发基于Zephyr的嵌入式设备固件更新方案
npx oh-my-skill add beriberikix/zephyr-agent-skills/security-updatescurl -fsSL https://oh-my-skill.com/install.sh | bash -s -- beriberikix/zephyr-agent-skills/security-updatesnpx oh-my-skill verify beriberikix/zephyr-agent-skills/security-updates怎么用
商店整理自技能原文 · 版本 ed63cdf · 表述以原文为准Claude 能帮你配置 Zephyr 系统的安全启动和固件更新，包括集成 MCUboot 引导加载程序、对固件镜像签名、通过 MCUmgr 远程更新、实现回滚保护以及使用 mbedTLS 加密。
当你需要实现 OTA 更新、保护启动过程或管理加密密钥时触发。
技能原文 SKILL.md
Zephyr Security & Updates
Build production-ready, secure embedded systems using Zephyr's modular security stack and MCUboot bootloader.
Core Workflows
1. MCUboot Integration
Set up the secure bootloader and define fail-safe flash partitions.
- Reference: [mcuboot_integration.md](references/mcuboot_integration.md)
- Key Tools:
CONFIG_BOOTLOADER_MCUBOOT,fixed-partitions, Devicetree.
2. Image Signing
Ensure firmware integrity with production-grade digital signatures.
- Reference: [image_signing.md](references/image_signing.md)
- Key Tools:
imgtool.py, ECDSA-P256, RSA.
3. DFU Protocols
Transport updates securely using MCUmgr or cloud-based OTA.
- Reference: [dfu_protocols.md](references/dfu_protocols.md)
- Key Tools:
mcumgr, Golioth OTA, SMP transport.
4. Rollback Protection
Implement atomic swaps and image confirmation to prevent bricking devices.
- Reference: [rollback_protection.md](references/rollback_protection.md)
- Key Tools:
boot_write_img_confirmed(),mcumgr image test.
5. Crypto Basics
Implement secure storage and cryptographic operations using mbedTLS.
- Reference: [crypto_basics.md](references/crypto_basics.md)
- Key Tools:
CONFIG_MBEDTLS, TF-M, secure storage.
Quick Start (Kconfig for Secure Boot)
# Enable MCUboot support in application CONFIG_BOOTLOADER_MCUBOOT=y
# Build with MCUboot using Sysbuild west build -b nucleo_f401re --sysbuild samples/basic/blinky
Professional Patterns (Security-First)
- Production Keys: Never use default MCUboot keys. Provision unique keys during manufacturing.
- Heartbeat Confirmation: Only confirm a new image after the application has successfully connected to its cloud backend.
- Version Integrity: Enable version monotonicity to prevent accidental or malicious firmware downgrades.
Automation Tools
- [mcuboot_version_guard.py](scripts/mcuboot_version_guard.py): Enforce monotonic semantic version progression in update pipelines.
Examples & Templates
- [mcuboot_prj_fragment.conf](assets/mcuboot_prj_fragment.conf): Starter secure-boot + image-management config fragment.
Validation Checklist
- [ ] Signed image verifies at boot and unsigned/tampered image is rejected.
- [ ] DFU flow completes end-to-end and boots into the new slot.
- [ ] Rollback behavior triggers correctly when image confirmation is withheld.
- [ ] Key handling and version policy prevent downgrade and test-key usage in production configs.
Resources
- [References](references/):
mcuboot_integration.md: Partition layouts and setup.image_signing.md: Key management andimgtoolusage.dfu_protocols.md: MCUmgr commands and cloud OTA.rollback_protection.md: Swap mechanisms and confirmation code.crypto_basics.md: mbedTLS and secure storage.- [Scripts](scripts/):
mcuboot_version_guard.py: Version monotonicity checker for release gates.- [Assets](assets/):
mcuboot_prj_fragment.conf: Secure-update config baseline.