Merge branch 'feat/bootloader-mbedtls-split-final' into 'master'

feat(esp_image_verify): split image verification out of bootloader_support

Closes IDF-8577 and IDFGH-17033

See merge request espressif/esp-idf!48383

docs/en/api-reference/system/ota.rst

@@ -235,7 +235,7 @@ The verification of signed OTA updates can be performed even without enabling ha
 Signed Data Partition Updates
 ------------------------------
 
-Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
+Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
 
 Sign data partition images using:
 

docs/en/migration-guides/release-6.x/6.2/security.rst

@@ -13,3 +13,17 @@ A PMP entry locked by the bootloader cannot be reconfigured until the next CPU r
 Applications built with ESP-IDF are not affected, as they program and lock the full PMP configuration themselves during startup, before any application code runs.
 
 Custom (non-ESP-IDF) applications launched by the ESP-IDF second stage bootloader must not assume that any PMP entries are pre-configured or locked at handoff. Previously, the bootloader configured and locked entries covering, e.g., the ROM and the peripheral address spaces; such applications must now program their own PMP configuration.
+
+
+Image verification split out of ``bootloader_support``
+------------------------------------------------------
+
+Image verification and secure-boot signature checking moved from
+``bootloader_support`` into the new ``esp_image_verify`` component. ``bootloader_support`` no longer depends on ``mbedtls``.
+
+- Components that relied on ``bootloader_support`` transitively providing ``mbedtls`` or ``app_update`` must now declare those dependencies explicitly in their ``PRIV_REQUIRES`` / ``REQUIRES``.
+- :cpp:func:`bootloader_common_get_sha256_of_partition` is deprecated. Use :cpp:func:`esp_partition_get_sha256` instead.
+- In builds that do not include the ``esp_image_verify`` component (no OTA or signed-image features), calling :cpp:func:`esp_partition_get_sha256` or the deprecated function above fails at link time with an undefined reference to ``esp_image_get_metadata`` / ``bootloader_sha256_flash_contents``. Add ``esp_image_verify`` (or ``app_update``, which includes it and provides the OTA APIs) to the calling component's ``PRIV_REQUIRES`` or to the project's ``COMPONENTS`` list.
+- Builds enabling :ref:`CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT` must include the ``esp_image_verify`` component, which provides the startup check that verifies the running app's signature.
+  Apps using OTA get it automatically through ``app_update``; apps that trim the component graph (e.g. ``MINIMAL_BUILD``) must add ``esp_image_verify`` (or ``app_update``) to a ``PRIV_REQUIRES`` list or the project ``COMPONENTS``. Such builds fail with a ``#error`` instead of silently skipping the configured check.
+- The Kconfig option ``CONFIG_SECURE_SIGNED_DATA_PARTITION`` was renamed to ``CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`` (old name still accepted via ``sdkconfig.rename``).

docs/en/security/secure-boot-v2.rst

@@ -420,7 +420,7 @@ An image is verified if the public key stored in any signature block is valid fo
 Verifying Data Partitions
 --------------------------
 
-The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
+The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
 
 Data partition images must be signed using ``idf.py secure-sign-data`` with the same signing key and follow the same format as application images. The verification uses the public key digest(s) stored in eFuse and follows the process described in :ref:`verify_image`.
 

docs/zh_CN/api-reference/system/ota.rst

@@ -235,7 +235,7 @@ Kconfig 中的 :menuitem:`CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE` 可以帮助用
 签名数据分区的更新
 ------------------
 
-数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
+数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
 
 使用以下命令对数据分区镜像进行签名：
 

docs/zh_CN/migration-guides/release-6.x/6.2/security.rst

@@ -13,3 +13,17 @@
 使用 ESP-IDF 构建的应用程序不受影响，因为应用程序会在启动阶段、任何应用代码运行之前，自行编程并锁定完整的 PMP 配置。
 
 由 ESP-IDF 二级引导加载程序启动的自定义（非 ESP-IDF）应用程序不得假定交接时任何 PMP 表项已被预先配置或锁定。此前，引导加载程序会配置并锁定覆盖 ROM 和外设地址空间等区域的表项；此类应用程序现在必须自行完成 PMP 配置。
+
+
+镜像校验功能从 ``bootloader_support`` 中拆分
+--------------------------------------------
+
+镜像校验与安全启动签名校验已从 ``bootloader_support`` 移至新的
+``esp_image_verify`` 组件。``bootloader_support`` 不再依赖 ``mbedtls``。
+
+- 此前通过 ``bootloader_support`` 间接获得 ``mbedtls`` 或 ``app_update`` 依赖的组件，现在必须在 ``PRIV_REQUIRES`` / ``REQUIRES`` 中显式声明。
+- :cpp:func:`bootloader_common_get_sha256_of_partition` 已弃用，请改用 :cpp:func:`esp_partition_get_sha256`。
+- 在未包含 ``esp_image_verify`` 组件的工程中（未启用 OTA 或签名镜像功能），调用 :cpp:func:`esp_partition_get_sha256` 或上述弃用函数会在链接时因 ``esp_image_get_metadata`` / ``bootloader_sha256_flash_contents`` 未定义引用而失败。请将 ``esp_image_verify`` （或 ``app_update``，它包含该组件并提供 OTA API）添加到调用组件的 ``PRIV_REQUIRES`` 或工程的 ``COMPONENTS`` 列表中。
+- 启用 :ref:`CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT` 的工程必须包含 ``esp_image_verify`` 组件，该组件提供启动时校验当前应用签名的检查。
+  使用 OTA 的应用会通过 ``app_update`` 自动引入该组件；裁剪组件依赖图的应用（如启用 ``MINIMAL_BUILD``）必须将 ``esp_image_verify`` （或 ``app_update``）添加到 ``PRIV_REQUIRES`` 或工程的 ``COMPONENTS`` 中。否则构建将以 ``#error`` 失败，而不会静默跳过已配置的安全检查。
+- Kconfig 选项 ``CONFIG_SECURE_SIGNED_DATA_PARTITION`` 已重命名为 ``CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`` （通过 ``sdkconfig.rename`` 兼容旧名称）。

docs/zh_CN/security/secure-boot-v2.rst

@@ -420,7 +420,7 @@
 验证数据分区
 ------------
 
-Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
+Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
 
 数据分区镜像必须使用相同的签名密钥，通过 ``idf.py secure-sign-data`` 进行签名，并采用与应用镜像相同的格式。验证使用存储在 eFuse 中的一个或多个公钥摘要，并遵循 :ref:`verify_image` 中所述的流程。