From e2c59acc52ea4a5339bf6dcd5977ea9b713d0327 Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Wed, 1 Jul 2026 10:46:05 +0530 Subject: [PATCH] test(examples/partitions_ota): handle RSA-less Secure Boot V2 on C2/C61 ESP32-C2 and ESP32-C61 have no RSA based Secure Boot V2 support, so the CI configs that pin the RSA signing scheme and key fail the app signing scheme/key check on these targets. - flash_enc_wifi_2.data_partition_verification: add C2/C61 sdkconfig overlays that switch to the ECDSA P-256 signing scheme and key (no force-enable needed as Secure Boot V2 itself is not enabled here). - on_update_no_sb_rsa: disable the build on targets without SOC_SECURE_BOOT_V2_RSA, mirroring simple_ota_example, since this config specifically exercises the RSA scheme. --- examples/system/.build-test-rules.yml | 2 ++ ...g.ci.flash_enc_wifi_2.data_partition_verification.esp32c2 | 5 +++++ ....ci.flash_enc_wifi_2.data_partition_verification.esp32c61 | 5 +++++ 3 files changed, 12 insertions(+) create mode 100644 examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c2 create mode 100644 examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c61 diff --git a/examples/system/.build-test-rules.yml b/examples/system/.build-test-rules.yml index 10b33e3a617..82f987a6b8c 100644 --- a/examples/system/.build-test-rules.yml +++ b/examples/system/.build-test-rules.yml @@ -201,6 +201,8 @@ examples/system/ota/partitions_ota: - if: CONFIG_NAME == "recovery_bootloader" and SOC_RECOVERY_BOOTLOADER_SUPPORTED != 1 temporary: true reason: disabled for targets that do not support recovery bootloader + - if: CONFIG_NAME == "on_update_no_sb_rsa" and SOC_SECURE_BOOT_V2_RSA != 1 + reason: Secure Boot V2 with RSA signatures is not supported. disable_test: - if: IDF_TARGET not in ["esp32", "esp32c3", "esp32s3"] temporary: true diff --git a/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c2 b/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c2 new file mode 100644 index 00000000000..2284e44cce0 --- /dev/null +++ b/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c2 @@ -0,0 +1,5 @@ +CONFIG_IDF_TARGET="esp32c2" + +# ESP32-C2 has no RSA based Secure Boot V2 support, so use the ECDSA scheme. +CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y +CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa.pem" diff --git a/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c61 b/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c61 new file mode 100644 index 00000000000..bb2dce4fd3c --- /dev/null +++ b/examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification.esp32c61 @@ -0,0 +1,5 @@ +CONFIG_IDF_TARGET="esp32c61" + +# ESP32-C61 has no RSA based Secure Boot V2 support, so use the ECDSA scheme. +CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y +CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa.pem"