Skip to content

Conversation

@m-alperen-sener
Copy link
Contributor

Deprecating BT_FIXED_PASSKEY and start using BT_APP_PASSKEY instead.

@m-alperen-sener m-alperen-sener requested review from a team as code owners November 4, 2025 16:10
@NordicBuilder NordicBuilder added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Nov 4, 2025
@NordicBuilder NordicBuilder requested a review from a team November 4, 2025 16:10
@NordicBuilder
Copy link
Contributor

NordicBuilder commented Nov 4, 2025

The following west manifest projects have changed revision in this Pull Request:

Name Old Revision New Revision Diff
matter nrfconnect/sdk-connectedhomeip@e5f2a2f (master) nrfconnect/sdk-connectedhomeip#653 nrfconnect/sdk-connectedhomeip#653/files
zephyr nrfconnect/sdk-zephyr@81edaae nrfconnect/sdk-zephyr#3466 nrfconnect/sdk-zephyr#3466/files

DNM label due to: 2 projects with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

@NordicBuilder
Copy link
Contributor

NordicBuilder commented Nov 4, 2025

CI Information

To view the history of this post, click the 'edited' button above
Build number: 6

Inputs:

Sources:

sdk-nrf: PR head: 708e406461747116808233bd063e44669e1d5cd8
matter: PR head: d68e77bbd9154ba2d3edf46daa112110f06769a6
zephyr: PR head: e84fa1b4757a94c7a7595769049c9a4e492b8862

more details

sdk-nrf:

PR head: 708e406461747116808233bd063e44669e1d5cd8
merge base: 4600f1d21714ccd8dc428aa7fe1f75963a526027
target head (main): e02b7a6c134b2610b0e89463dac95e74a45f849b
Diff

matter:

PR head: d68e77bbd9154ba2d3edf46daa112110f06769a6
merge base: e5f2a2ff99493d9862a3aa5e370681287cf53cf0
target head (master): e5f2a2ff99493d9862a3aa5e370681287cf53cf0
Diff

zephyr:

PR head: e84fa1b4757a94c7a7595769049c9a4e492b8862
merge base: a9bbd349efde16d5b89d65ce369c307a422327b9
target head (main): 9a54011af2dfd7b7e4b8b0b8a46f02961ad58511
Diff

Github labels

Enabled Name Description
ci-disabled Disable the ci execution
ci-all-test Run all of ci, no test spec filtering will be done
ci-force-downstream Force execution of downstream even if twister fails
ci-run-twister Force run twister
ci-run-zephyr-twister Force run zephyr twister
List of changed files detected by CI (22)
doc
│  ├── nrf
│  │  ├── libraries
│  │  │  ├── bluetooth
│  │  │  │  ├── mesh
│  │  │  │  │  ├── vnd
│  │  │  │  │  │  ├── images
│  │  │  │  │  │  │  │ bt_mesh_le_pair_resp.svg
│  │  │  │  │  │  │ le_pair_resp.rst
│  │  ├── releases_and_maturity
│  │  │  ├── migration
│  │  │  │  │ migration_guide_3.2.rst
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
include
│  ├── bluetooth
│  │  ├── mesh
│  │  │  ├── vnd
│  │  │  │  │ le_pair_resp.h
modules
│  ├── lib
│  │  ├── matter
│  │  │  ├── config
│  │  │  │  ├── nrfconnect
│  │  │  │  │  ├── chip-module
│  │  │  │  │  │  │ Kconfig.features
samples
│  ├── bluetooth
│  │  ├── mesh
│  │  │  ├── common
│  │  │  │  │ smp_bt_auth.c
│  │  │  ├── dfu
│  │  │  │  ├── distributor
│  │  │  │  │  │ overlay-smp-bt-auth.conf
│  ├── matter
│  │  ├── common
│  │  │  ├── src
│  │  │  │  ├── bt_nus
│  │  │  │  │  ├── bt_nus_service.cpp
│  │  │  │  │  │ bt_nus_service.h
│  │  ├── lock
│  │  │  │ sample.yaml
subsys
│  ├── bluetooth
│  │  ├── mesh
│  │  │  ├── vnd
│  │  │  │  ├── Kconfig
│  │  │  │  │ le_pair_resp.c
west.yml
zephyr
│  ├── doc
│  │  ├── releases
│  │  │  │ migration-guide-4.3.rst
│  ├── include
│  │  ├── zephyr
│  │  │  ├── bluetooth
│  │  │  │  │ conn.h
│  ├── subsys
│  │  ├── bluetooth
│  │  │  ├── host
│  │  │  │  ├── Kconfig
│  │  │  │  ├── shell
│  │  │  │  │  │ bt.c
│  │  │  │  │ smp.c
│  ├── tests
│  │  ├── bluetooth
│  │  │  ├── shell
│  │  │  │  ├── audio.conf
│  │  │  │  ├── log.conf
│  │  │  │  │ prj.conf

Outputs:

Toolchain

Version: df3cc9d822
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:df3cc9d822_e595b21c39

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

  • ◻️ Toolchain - Skipped: existing toolchain is used
  • ✅ Build twister
    • sdk-nrf test count: 1428
    • sdk-zephyr test count: 677
  • ❌ Integration tests
    • ✅ test-sdk-audio
    • ✅ desktop52_verification
    • ✅ test_ble_nrf_config
    • ✅ test-fw-nrfconnect-ble_mesh
    • ✅ test-fw-nrfconnect-ble_samples
    • ✅ test-fw-nrfconnect-chip
    • ✅ test-fw-nrfconnect-nfc
    • ✅ test-fw-nrfconnect-nrf-iot_thingy91
    • ✅ test-sdk-find-my
    • ❌ test-low-level
    • ✅ test-sdk-dfu
Disabled integration tests
    • test-fw-nrfconnect-nrf_lrcs_positioning
    • test-fw-nrfconnect-apps
    • test-fw-nrfconnect-fem
    • test-fw-nrfconnect-nrf-iot_libmodem-nrf
    • test-fw-nrfconnect-nrf-iot_lwm2m
    • test-fw-nrfconnect-nrf-iot_samples
    • test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
    • test-fw-nrfconnect-nrf_crypto
    • test-fw-nrfconnect-ps-main
    • test-fw-nrfconnect-rpc
    • test-fw-nrfconnect-rs
    • test-fw-nrfconnect-tfm
    • test-fw-nrfconnect-thread-main
    • test-sdk-mcuboot
    • test-sdk-wifi
    • test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

@github-actions
Copy link

github-actions bot commented Nov 4, 2025

You can find the documentation preview for this PR here.

Copy link
Contributor

@PavelVPV PavelVPV left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think smp_bt_auth.c for sure should not use the deprecated API and should only be compiled with CONFIG_BT_APP_PASSKEY.

But also I think that since the LE Pairing Responder model is experimental, it is OK to change it is behavior and API without deprecation period. But we need to mention this change in the release notes.

Also, remember to update documentation of the model: https://github.com/nrfconnect/sdk-nrf/blob/main/doc/nrf/libraries/bluetooth/mesh/vnd/le_pair_resp.rst.

@m-alperen-sener m-alperen-sener force-pushed the deprace_bt_fixed_appkey branch from 2999999 to 0d6a557 Compare November 5, 2025 15:56
@m-alperen-sener m-alperen-sener requested review from a team as code owners November 5, 2025 15:56
@NordicBuilder NordicBuilder added doc-required PR must not be merged without tech writer approval. and removed changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Nov 5, 2025
@NordicBuilder NordicBuilder requested review from a team November 5, 2025 15:56
Copy link
Contributor Author

@m-alperen-sener m-alperen-sener left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the documentation and added release notes for DFU distributer sample and LE Pair Responder model.

Remove all dependency on deprecated FIXED_PASSKEY, solely it depends on APP_PASSKEY now.

Removed immediate invalidation of passkey.

Update the Documentation diagram.

added commit to update matter door lock sample.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we show the usage of bt_mesh_le_pair_resp_passkey_get function on diagram? In the app_passkey callback.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO:

Copy link
Contributor

@ArekBalysNordic ArekBalysNordic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some changes are required in the Matter Lock sample.

@m-alperen-sener m-alperen-sener force-pushed the deprace_bt_fixed_appkey branch from 0d6a557 to d30f085 Compare November 6, 2025 08:49
:depth: 2

The LE Pairing Responder model is a vendor model.
The LE Pairing Responder model is a vendor model and it requires :kconfig:option:`CONFIG_BT_APP_PASSKEY` option to be enabled.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The LE Pairing Responder model is a vendor model and it requires :kconfig:option:`CONFIG_BT_APP_PASSKEY` option to be enabled.
The LE Pairing Responder model is a vendor model and you must enable the :kconfig:option:`CONFIG_BT_APP_PASSKEY` Kconfig option to use this model.

This model can be used to hand over a passkey that will authenticate a Bluetooth LE connection over a mesh network when it is not possible to use other pairing methods.

Before the pairing is initiated, an initiator should send an LE Pairing message with Passkey Reset sub-opcode to set a new passkey for the next pairing request.
Before the pairing is initiated, an initiator should send an LE Pairing message with Passkey Reset sub-opcode. If the passkey has been set by the :c:func:`bt_mesh_le_pair_resp_passkey_set` function, the predefined passkey will be returned in the Passkey Status message. Otherwise, a new passkey will be generated by LE Pairing Responder model and returned in the Passkey Status message.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Before the pairing is initiated, an initiator should send an LE Pairing message with Passkey Reset sub-opcode. If the passkey has been set by the :c:func:`bt_mesh_le_pair_resp_passkey_set` function, the predefined passkey will be returned in the Passkey Status message. Otherwise, a new passkey will be generated by LE Pairing Responder model and returned in the Passkey Status message.
Before the pairing is initiated, an initiator must send an LE Pairing message with the Passkey Reset sub-opcode.
If the passkey has been set by the :c:func:`bt_mesh_le_pair_resp_passkey_set` function, the predefined passkey is returned in the Passkey Status message.
Otherwise, a new passkey will be generated by the LE Pairing Responder model and returned in the Passkey Status message.

/** @brief Get passkey to be used in the very next pairing.
*
* This function will return the passkey set by the @ref bt_mesh_le_pair_resp_passkey_set function or it will return
* a randomly generated passkey by the Reset message.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* a randomly generated passkey by the Reset message.
* a randomly generated passkey by the reset message.

Comment on lines 386 to 393
* Updated the :makevar:`FILE_SUFFIX` make variable to use more descriptive suffixes for external flash configurations.
The new suffixes are ``_dfu_ext_flash`` for external flash DFU storage and ``_ext_flash_settings`` for external flash settings storage.

* Updated the sample to use the :kconfig:option:`CONFIG_BT_APP_PASSKEY` option instead of the deprecated :kconfig:option:`CONFIG_BT_FIXED_PASSKEY` option.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Updated the :makevar:`FILE_SUFFIX` make variable to use more descriptive suffixes for external flash configurations.
The new suffixes are ``_dfu_ext_flash`` for external flash DFU storage and ``_ext_flash_settings`` for external flash settings storage.
* Updated the sample to use the :kconfig:option:`CONFIG_BT_APP_PASSKEY` option instead of the deprecated :kconfig:option:`CONFIG_BT_FIXED_PASSKEY` option.
* Updated:
* The :makevar:`FILE_SUFFIX` make variable to use more descriptive suffixes for external flash configurations.
The new suffixes are ``_dfu_ext_flash`` for external flash DFU storage and ``_ext_flash_settings`` for external flash settings storage.
* The sample to use the :kconfig:option:`CONFIG_BT_APP_PASSKEY` option instead of the deprecated :kconfig:option:`CONFIG_BT_FIXED_PASSKEY` option.

After every pairing request, the application must invalidate the previously used passkey by calling the :c:func:`bt_mesh_le_pair_resp_passkey_invalidate` function.
This function can be called from callbacks :c:member:`bt_conn_auth_info_cb.pairing_complete` and :c:member:`bt_conn_auth_info_cb.pairing_failed`.
See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.
This model requires an application to only enable the display capability for the LE pairing by setting the :c:member:`bt_conn_auth_cb.pairing_display` callback. The application must also set the :c:member:`bt_conn_auth_cb.app_passkey` callback to use the passkey generated by LE Pairing Responder model.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
This model requires an application to only enable the display capability for the LE pairing by setting the :c:member:`bt_conn_auth_cb.pairing_display` callback. The application must also set the :c:member:`bt_conn_auth_cb.app_passkey` callback to use the passkey generated by LE Pairing Responder model.
This model requires an application to only enable the display capability for the LE pairing by setting the :c:member:`bt_conn_auth_cb.passkey_display` callback.
The application must also set the :c:member:`bt_conn_auth_cb.app_passkey` callback to use the passkey generated by the LE Pairing Responder model.

Is passkey_display the correct call instead of pairing_display?
Is app_passkey the correct callback?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch.

app_passkey comes with the cherry-picking PR: https://github.com/nrfconnect/sdk-zephyr/pull/3466/files

See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.
This model requires an application to only enable the display capability for the LE pairing by setting the :c:member:`bt_conn_auth_cb.pairing_display` callback. The application must also set the :c:member:`bt_conn_auth_cb.app_passkey` callback to use the passkey generated by LE Pairing Responder model.
After every pairing request, the application must invalidate the previously used passkey by calling the :c:func:`bt_mesh_le_pair_resp_passkey_invalidate` function or calling :c:func:`bt_mesh_le_pair_resp_passkey_set` with :ref:`BT_PASSKEY_RAND` value.
Those functions can be called from callbacks :c:member:`bt_conn_auth_info_cb.pairing_complete` and :c:member:`bt_conn_auth_info_cb.pairing_failed`. See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Those functions can be called from callbacks :c:member:`bt_conn_auth_info_cb.pairing_complete` and :c:member:`bt_conn_auth_info_cb.pairing_failed`. See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.
Those functions can be called from callbacks :c:member:`bt_conn_auth_info_cb.pairing_complete` and :c:member:`bt_conn_auth_info_cb.pairing_failed`.
See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.

This function can be called from callbacks :c:member:`bt_conn_auth_info_cb.pairing_complete` and :c:member:`bt_conn_auth_info_cb.pairing_failed`.
See the :file:`samples/bluetooth/mesh/common/smp_bt_auth.c` file for the reference.
This model requires an application to only enable the display capability for the LE pairing by setting the :c:member:`bt_conn_auth_cb.pairing_display` callback. The application must also set the :c:member:`bt_conn_auth_cb.app_passkey` callback to use the passkey generated by LE Pairing Responder model.
After every pairing request, the application must invalidate the previously used passkey by calling the :c:func:`bt_mesh_le_pair_resp_passkey_invalidate` function or calling :c:func:`bt_mesh_le_pair_resp_passkey_set` with :ref:`BT_PASSKEY_RAND` value.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
After every pairing request, the application must invalidate the previously used passkey by calling the :c:func:`bt_mesh_le_pair_resp_passkey_invalidate` function or calling :c:func:`bt_mesh_le_pair_resp_passkey_set` with :ref:`BT_PASSKEY_RAND` value.
After every pairing request, the application must invalidate the previously used passkey by calling the :c:func:`bt_mesh_le_pair_resp_passkey_invalidate` function or calling :c:func:`bt_mesh_le_pair_resp_passkey_set` with the ``BT_PASSKEY_RAND`` value.

Any specific reason for using ref for a value?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps it should be :c:macro:BT_PASSKEY_RAND?

Copy link
Contributor Author

@m-alperen-sener m-alperen-sener Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not able to check this locally, does :c:macro: works with zephyr defined ones? I mean can doc pick up from zephyr?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice, we can do that then 👍

Manifest update to depracate and replace BT_FIXED_PADDKEY

Signed-off-by: alperen sener <[email protected]>
Copy link
Contributor Author

@m-alperen-sener m-alperen-sener left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed the Doc reviews.

Replaced the matter sample commit with the one given by @ArekBalysNordic with connectedhomeip revision.

I ll update the diagram once I have it, until then at least we can merge the sdk-zephyr, and sdk-connectedhomeip PRs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO:

Copy link
Contributor

@ArekBalysNordic ArekBalysNordic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@m-alperen-sener m-alperen-sener force-pushed the deprace_bt_fixed_appkey branch from 27124bd to 6064145 Compare November 6, 2025 15:37
m-alperen-sener and others added 3 commits November 6, 2025 16:46
BT_FIXED_PASSKEY is depracated so wee need to aling the le pair
responder model with the new Kconfig BT_APP_PASSKEY usage.

Adding bt_mesh_le_pair_resp_passkey_get to be able to retreive
the passkey set randomly or by app.

Signed-off-by: alperen sener <[email protected]>
BT_FIXED_PASSKEY is deprecated, thus we start using BT_APP_PASSKEY

Signed-off-by: alperen sener <[email protected]>
CONFIG_BT_FIXED_PASSKEY has been deprecated. We switched to
CONFIG_BT_APP_PASSKEY and added a migration guide entry.

Signed-off-by: Arkadiusz Balys <[email protected]>
@m-alperen-sener m-alperen-sener force-pushed the deprace_bt_fixed_appkey branch from 6064145 to 708e406 Compare November 6, 2025 15:46
Copy link
Contributor Author

@m-alperen-sener m-alperen-sener left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doc fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

DNM doc-required PR must not be merged without tech writer approval. manifest manifest-matter manifest-zephyr

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants