4. Line PC Setup
This chapter is performed by the CM on each line PC.
- Install
sid-mfg-tool. On macOS or Linux, run:
curl -fsSL https://github.com/amzn/sid-mfg-tool/releases/latest/download/install.sh | sh
On Windows, download the .exe and verify its SHA-256 checksum. Verify the installation with sid-mfg-tool --version. If the line uses RTT, also install the SEGGER J-Link Software and Documentation Pack from segger.com in its standard location. The tool drives the J-Link probe through the JLinkARM library of that pack, which is not bundled with the tool. The tool and the Factory Diagnostic Firmware are version-paired: deploy the combination listed in the release notes.
- Run the YubiHSM connector. The YubiHSM connector communicates with the HSM, as in the existing mass production flow:
yubihsm-connector -l 127.0.0.1:12345
curl http://127.0.0.1:12345/connector/status
- Configure the tool (once per line PC). Run
sid-mfg-tool configure. The tool writes the non-secret settings to~/.config/sid-mfg-tool/config.tomland the secrets (DAK PIN, LWA client credentials, application server public key) to~/.config/sid-mfg-tool/secrets.tomlwith file mode 0600. LWA tokens are cached in~/.cache/sid-mfg-tool/tokens.json, also with mode 0600. The prompts are described in the following table.
| Prompt | Value |
|---|---|
| Product name | The product tag from the HSM handoff (Section 3.5). It must match the label of the DAK in the HSM |
| Device type | The DeviceTypeId vended by Amazon with the HSM (Section 3.5) |
| Advertised Product ID (APID) | From the device profile (Section 3.4) |
| HSM signing stage | prod (or preprod) |
| HSM connector URI | For example http://127.0.0.1:12345 |
| Default transport | uart (serial port) or rtt (SEGGER RTT through a J-Link probe). The device commands use this transport unless --transport is given |
| J-Link device name of the target MCU (rtt only) | The J-Link device name of the MCU, stored as jlink_device, as listed by the SEGGER J-Link software |
| IoT Wireless destination | The destination created in Section 3.4. It must already exist |
| Device creation mode | immediate (default) or bulk |
| S3 bucket and import role (bulk only) | The S3 bucket that receives the SMSN CSV for the bulk import task, and the IAM role ARN the import task uses to read it (Section 3.4) |
| Control log delivery | api (default) or sftp. sftp requires device creation mode bulk |
| SFTP upload host and username, SFTP feedback host and username, SSH private key path (sftp only) | The SFTP account used for control log delivery. Uploads go to /To_Amazon and acknowledgements are read from /From_Amazon. The host key must already be in known_hosts, and the key file must have mode 0600 |
| Security level | security-level-high (default, stored as high) or security-level-low (stored as low) in the security_level key. It must match the SDK variant of the production firmware (Section 7.1) |
| AWS profile name | The named AWS CLI profile from Section 3.4 |
| Audit log directory | Accept the default (~/.sid-mfg-tool/audit) |
| HSM PIN (secret) | The DAK PIN, decrypted from Amazon’s encrypted email (Section 3.5) |
| LWA client_id and client_secret (secrets) | From your LWA security profile (Section 3.2) |
| App key (secret) | The application server public key (64 hexadecimal characters) from your device profile (Section 3.4) |
The retention_days setting can only be set in the configuration file. It controls how long processed artifacts are kept (default 90 days). At the end of configure, verify the AWS account that the tool prints and complete the browser login. The tokens are cached and refreshed automatically. To review the configuration at any time, run sid-mfg-tool configure --show.
High-volume and offline lines. Two settings allow the cloud steps to be batched:
| Device creation | Control log delivery | Line PC needs network access | Command sequence |
|---|---|---|---|
immediate (default) | api | Yes | device onboard for each device |
bulk | api | For the control log upload only | device provision, then bulk-provision run, then device register |
bulk | sftp | No | device provision, then control-log upload, then bulk-provision run, then device register |