Merge branch 'feat/bootloader-mbedtls-split-final' into 'master'

feat(esp_image_verify): split image verification out of bootloader_support

Closes IDF-8577 and IDFGH-17033

See merge request espressif/esp-idf!48383

tools/idf_py_actions/hints.yml

@@ -592,3 +592,12 @@
 -
     re: "error: 'WIFI_BW_HT40' undeclared \\(first use in this function\\)"
     hint: "The enum value 'WIFI_BW_HT40' has been removed. Use 'WIFI_BW40' instead."
+
+-
+    re: "undefined reference to `(esp_image_get_metadata|bootloader_sha256_flash_contents|bootloader_sha384_flash_contents)'"
+    hint: "'{}' is provided by the esp_image_verify component, which is not in the build. APIs such as esp_partition_get_sha256() need it. Add esp_image_verify (or app_update, which includes it and provides the OTA APIs) to the calling component's PRIV_REQUIRES or to the project's COMPONENTS list."
+    match_to_output: True
+
+-
+    re: "undefined reference to `esp_secure_boot_check_signature_on_update'"
+    hint: "CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT requires the startup signature check from the esp_image_verify component, which is not in the build. Add esp_image_verify (or app_update, which includes it) to the calling component's PRIV_REQUIRES or to the project's COMPONENTS list."

tools/test_apps/security/signed_app_no_secure_boot/main/CMakeLists.txt

@@ -1,3 +1,3 @@
 idf_component_register(SRCS "main.c"
                     INCLUDE_DIRS "."
-                    PRIV_REQUIRES nvs_flash)
+                    PRIV_REQUIRES nvs_flash esp_image_verify)

tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt

@@ -1,2 +1,3 @@
 idf_component_register(SRCS "test_main.c"
+                       REQUIRES mbedtls
                        INCLUDE_DIRS ".")

tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt

@@ -1,2 +1,3 @@
 idf_component_register(SRCS "test_main.c"
+                       REQUIRES mbedtls
                        INCLUDE_DIRS ".")

tools/test_apps/system/g1_components/CMakeLists.txt

@@ -44,11 +44,6 @@ set(extra_allowed_components
 # These components are currently included into "G1" build, but shouldn't.
 # After removing the extra dependencies, remove the components from this list as well.
 set(extra_components_which_shouldnt_be_included
-    # app_update gets added because of spi_flash and esp_partition.
-    # esp_partition will get removed from g1 and spi_flash does not actually seem to need app_update anymore.
-    # When esp-partition is removed from g1 build it should be easy for us to also remove app-update # TODO IDF-8577
-    app_update
-
     # bootloader is only included from esptool_py, which should be removed from G1
     bootloader
 
@@ -85,7 +80,7 @@ set(extra_components_which_shouldnt_be_included
     # esp_pm is pulled in by esp_system due to pm_init and freertos idle hook
     # both could be moved to pm component if esp-system idle hook provided a way to register hooks
     # esp_hw_support dependency seems like it could be removed?
-    # It is also used by esp_driver_gpio, mbedtls all of which should be removed from G1-only build.
+    # It is also used by esp_driver_gpio, which should be removed from G1-only build.
     # IDF-10415
     esp_pm
 
@@ -101,10 +96,6 @@ set(extra_components_which_shouldnt_be_included
     #   should be removed from G1-only build.
     esptool_py
 
-    # mbedtls is a dependency of bootloader_support (plus other easier-to-remove ones)
-    #   it is hard to make it conditional, need to remove bootloader_support.
-    mbedtls
-
     # partition_table is pulled in by app_update, esptool_py, bootloader, esp_partition; all to be removed
     partition_table
 
@@ -118,12 +109,9 @@ set(extra_components_which_shouldnt_be_included
     # pthread is required by cxx. See [refactor-todo] about cxx, can it work without pthread?
     pthread
 
-    # esp_security is required by mbedtls and spi_flash
+    # esp_security is required by spi_flash
     esp_security
 
-    # esp_driver_dma is required by mbedtls
-    esp_driver_dma
-
     # esp_usb_cdc_rom_console is used by the panic handler, will be conditional on cdc console option when
     # the new build-system is implemented
     esp_usb_cdc_rom_console

tools/test_apps/system/mmu_page_size/main/CMakeLists.txt

@@ -1,2 +1,2 @@
 idf_component_register(SRCS "main.c"
-                        PRIV_REQUIRES unity esp_partition bootloader_support)
+                        PRIV_REQUIRES unity esp_partition bootloader_support esp_image_verify)