fix(build): prepare dependents for bootloader_support dropping mbedtls

bootloader_support is about to stop pulling mbedtls (and app_update) into
every build graph, so components and apps that relied on those transitive
edges must own their dependencies

Closes https://github.com/espressif/esp-idf/issues/18072
Related https://github.com/espressif/esp-idf/issues/18778

components/mbedtls/CMakeLists.txt

@@ -542,6 +542,13 @@ else()
     target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u mbedtls_psa_crypto_init_include_impl")
 endif()
 
+# Force-link esp_mem.c so esp_mbedtls_mem_calloc/free are present whenever
+# mbedtls is in the link. Without this, link order breaks for apps that pull
+# mbedtls but don't call any mbedtls function
+if(NOT (CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin" AND ${IDF_TARGET} STREQUAL "linux"))
+    target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u esp_mbedtls_mem_calloc")
+endif()
+
 # Additional optional dependencies for the mbedcrypto library
 function(builtin_optional_deps component_name)
     idf_build_get_property(components BUILD_COMPONENTS)

components/nvs_flash/CMakeLists.txt

@@ -63,7 +63,12 @@ else()
     set(requires esp_partition esp_blockdev)
     set(priv_requires spi_flash)
     if(NOT ${target} STREQUAL "linux")
-        list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider)
+        # mbedtls is needed for NVS encryption (nvs_encrypted_partition.cpp).
+        # It used to be pulled in transitively via bootloader_support, but
+        # that dep was removed in the bootloader_support / esp_image_verify
+        # split. Declare it explicitly so `idf::mbedtls` exists for the
+        # target_link_libraries() call below.
+        list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider mbedtls)
     endif()
 
     idf_component_register(SRCS "${srcs}"