Re: [cip-dev] [isar-cip-core][PATCH v1 2/2] swupdate.cfg.tmpl: Add digest-provider option for signature verification

[Quirin Gylstorff <quirin.gylstorff@siemens.com>]

On 7/20/26 6:59 AM, Kunijadar Shivanand wrote:
> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> 
> This option is introduced from v2025.12 onwards in the SWUpdate package.
> It sets the crypto backend (mbedTLS) that the SWUpdate uses to verify
> signed updates and compute digests when multiple provides are available.
> 
> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> ---
>   .../files/{swupdate.cfg => swupdate.cfg.tmpl}             | 1 +
>   recipes-core/swupdate-config/swupdate-config_0.2.bb       | 8 +++++---
>   2 files changed, 6 insertions(+), 3 deletions(-)
>   rename recipes-core/swupdate-config/files/{swupdate.cfg => swupdate.cfg.tmpl} (77%)
> 
> diff --git a/recipes-core/swupdate-config/files/swupdate.cfg b/recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> similarity index 77%
> rename from recipes-core/swupdate-config/files/swupdate.cfg
> rename to recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> index 3e2b45c..44d8d04 100644
> --- a/recipes-core/swupdate-config/files/swupdate.cfg
> +++ b/recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> @@ -2,4 +2,5 @@ globals :
>   {
>       bootloader = "ebg";
>       public-key-file = "/usr/share/swupdate-signing/swupdate-sign.crt"
here is semicolon missing.
> +    ${SWUPDATE_DIGEST_PROVIDER}
>   };
> diff --git a/recipes-core/swupdate-config/swupdate-config_0.2.bb b/recipes-core/swupdate-config/swupdate-config_0.2.bb
> index b48e3d1..584706c 100644
> --- a/recipes-core/swupdate-config/swupdate-config_0.2.bb
> +++ b/recipes-core/swupdate-config/swupdate-config_0.2.bb
> @@ -19,12 +19,14 @@ DEBIAN_PROVIDES := "${PN}"
>   
>   PN .= "-${MACHINE}"
>   
> -SRC_URI = "file://swupdate.cfg \
> +SRC_URI = "file://swupdate.cfg.tmpl \
>              file://hwrevision.tmpl"
>   
> +SWUPDATE_DIGEST_PROVIDER ??= ""
> +SWUPDATE_DIGEST_PROVIDER:sid = "digest-provider = "pkcs#7mbedtls";"

It would be better to pin the version for the previous versions instead 
of sid.

Quirin

>   MACHINE_HW_VERSION ??= "cip-core-1.0"
> -TEMPLATE_FILES += "hwrevision.tmpl"
> -TEMPLATE_VARS += "MACHINE MACHINE_HW_VERSION"
> +TEMPLATE_FILES += "hwrevision.tmpl swupdate.cfg.tmpl"
> +TEMPLATE_VARS += "MACHINE MACHINE_HW_VERSION SWUPDATE_DIGEST_PROVIDER"
>   
>   do_install[cleandirs] = "${D}/etc/"
>   do_install() {
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#23670): https://lists.cip-project.org/g/cip-dev/message/23670
> Mute This Topic: https://lists.cip-project.org/mt/120354799/1753640
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/unsub [quirin.gylstorff@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>