From 8589d9df255a5514cfacc78b0f48aedf03623277 Mon Sep 17 00:00:00 2001
From: Ashish Sharma <ashish.sharma@espressif.com>
Date: Wed, 8 Jul 2026 15:50:48 +0800
Subject: [PATCH] fix(build): prepare dependents for bootloader_support
 dropping mbedtls

bootloader_support is about to stop pulling mbedtls (and app_update) into
every build graph, so components and apps that relied on those transitive
edges must own their dependencies

Closes https://github.com/espressif/esp-idf/issues/18072
Related https://github.com/espressif/esp-idf/issues/18778
---
 components/mbedtls/CMakeLists.txt                          | 7 +++++++
 components/nvs_flash/CMakeLists.txt                        | 7 ++++++-
 .../build_system/cmake/import_prebuilt/main/CMakeLists.txt | 1 +
 .../cmakev2/features/import_prebuilt/main/CMakeLists.txt   | 1 +
 examples/system/ota/otatool/main/CMakeLists.txt            | 1 +
 .../build_tests/client_only_mbedtls/main/CMakeLists.txt    | 1 +
 .../build_tests/no_esp_cert_bundle/main/CMakeLists.txt     | 1 +
 7 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/components/mbedtls/CMakeLists.txt b/components/mbedtls/CMakeLists.txt
index 27fcd277c23..a7832499f10 100644
--- a/components/mbedtls/CMakeLists.txt
+++ b/components/mbedtls/CMakeLists.txt
@@ -542,6 +542,13 @@ else()
     target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u mbedtls_psa_crypto_init_include_impl")
 endif()
 
+# Force-link esp_mem.c so esp_mbedtls_mem_calloc/free are present whenever
+# mbedtls is in the link. Without this, link order breaks for apps that pull
+# mbedtls but don't call any mbedtls function
+if(NOT (CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin" AND ${IDF_TARGET} STREQUAL "linux"))
+    target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u esp_mbedtls_mem_calloc")
+endif()
+
 # Additional optional dependencies for the mbedcrypto library
 function(builtin_optional_deps component_name)
     idf_build_get_property(components BUILD_COMPONENTS)
diff --git a/components/nvs_flash/CMakeLists.txt b/components/nvs_flash/CMakeLists.txt
index d3abf208a19..c0088b36bf2 100644
--- a/components/nvs_flash/CMakeLists.txt
+++ b/components/nvs_flash/CMakeLists.txt
@@ -63,7 +63,12 @@ else()
     set(requires esp_partition esp_blockdev)
     set(priv_requires spi_flash)
     if(NOT ${target} STREQUAL "linux")
-        list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider)
+        # mbedtls is needed for NVS encryption (nvs_encrypted_partition.cpp).
+        # It used to be pulled in transitively via bootloader_support, but
+        # that dep was removed in the bootloader_support / esp_image_verify
+        # split. Declare it explicitly so `idf::mbedtls` exists for the
+        # target_link_libraries() call below.
+        list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider mbedtls)
     endif()
 
     idf_component_register(SRCS "${srcs}"
diff --git a/examples/build_system/cmake/import_prebuilt/main/CMakeLists.txt b/examples/build_system/cmake/import_prebuilt/main/CMakeLists.txt
index 6c0888f23c2..50b4813f6a7 100644
--- a/examples/build_system/cmake/import_prebuilt/main/CMakeLists.txt
+++ b/examples/build_system/cmake/import_prebuilt/main/CMakeLists.txt
@@ -1,4 +1,5 @@
 idf_component_register(SRCS "main.c"
+                    PRIV_REQUIRES app_update
                     INCLUDE_DIRS ".")
 
 # Import the library, specifying a target name and the library path.
diff --git a/examples/build_system/cmakev2/features/import_prebuilt/main/CMakeLists.txt b/examples/build_system/cmakev2/features/import_prebuilt/main/CMakeLists.txt
index 6c0888f23c2..50b4813f6a7 100644
--- a/examples/build_system/cmakev2/features/import_prebuilt/main/CMakeLists.txt
+++ b/examples/build_system/cmakev2/features/import_prebuilt/main/CMakeLists.txt
@@ -1,4 +1,5 @@
 idf_component_register(SRCS "main.c"
+                    PRIV_REQUIRES app_update
                     INCLUDE_DIRS ".")
 
 # Import the library, specifying a target name and the library path.
diff --git a/examples/system/ota/otatool/main/CMakeLists.txt b/examples/system/ota/otatool/main/CMakeLists.txt
index 5cbf3000e11..88582b56bbb 100644
--- a/examples/system/ota/otatool/main/CMakeLists.txt
+++ b/examples/system/ota/otatool/main/CMakeLists.txt
@@ -1,2 +1,3 @@
 idf_component_register(SRCS "otatool_main.c"
+                    PRIV_REQUIRES app_update
                     INCLUDE_DIRS ".")
diff --git a/tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt b/tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt
index 1df31fac804..a94deb19f54 100644
--- a/tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt
+++ b/tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt
@@ -1,2 +1,3 @@
 idf_component_register(SRCS "test_main.c"
+                       REQUIRES mbedtls
                        INCLUDE_DIRS ".")
diff --git a/tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt b/tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt
index 1df31fac804..a94deb19f54 100644
--- a/tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt
+++ b/tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt
@@ -1,2 +1,3 @@
 idf_component_register(SRCS "test_main.c"
+                       REQUIRES mbedtls
                        INCLUDE_DIRS ".")