Merge branch 'fix/sb_digest_revocation_workflow' into 'master'

change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot

See merge request espressif/esp-idf!49553

components/bootloader/Kconfig.projbuild

@@ -1010,13 +1010,8 @@ menu "Security features"
                 Revoking unused digest slots makes ensures that no trusted keys can be added later by an attacker.
                 If set, it means that you have a plan to use unused digests slots later.
 
-                Note that if you plan to enable secure boot during the first boot up, the bootloader will intentionally
-                revoke the unused digest slots while enabling secure boot, even if the above config is enabled because
-                keeping the unused key slots un-revoked would a security hazard.
-                In case for any development workflow if you need to avoid this revocation, you should enable
-                secure boot externally (host based mechanism) rather than enabling it during the boot up,
-                so that the bootloader would not need to enable secure boot and thus you could avoid its revocation
-                strategy.
+                This config is honored both at runtime in the app and while enabling secure boot during the first
+                boot up in the bootloader. When set, the unused digest slots are left un-revoked in both cases.
 
         config SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
             bool "Skip write-protection of SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH"

components/bootloader_support/src/secure_boot_v2/secure_boot.c

@@ -347,8 +347,12 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
     if (boot_key_digests.num_digests < SECURE_BOOT_NUM_BLOCKS) {
         /* The revocation index can be 0, 1, 2. Bootloader count can be 1,2,3. */
         for (unsigned i = boot_key_digests.num_digests; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+#ifndef CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
             ESP_LOGI(TAG, "Revoking empty key digest slot (%d)...", i);
             esp_efuse_set_digest_revoke(i);
+#else
+            ESP_LOGW(TAG, "Unused key digest slot (%d) left un-revoked due to the config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS", i);
+#endif
         }
     }
 #endif // SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS