Re: [cip-dev] [isar-cip-core][PATCH v1 2/2] swupdate.cfg.tmpl: Add digest-provider option for signature verification

Hi Quirin, 

Thank you for the review. 

> It would be better to pin the version for the previous versions instead of sid.

Does this mean keep SWUPDATE_DIGEST_PROVIDER = "digest-provider = "pkcs#7mbedtls";"  and add version specific variables like below? Please confirm. 
 
SWUPDATE_LUA_VERSION:trixie = ""
SWUPDATE_LUA_VERSION:bookworm = ""
SWUPDATE_DIGEST_PROVIDER:bullseye =""
SWUPDATE_DIGEST_PROVIDER:buster = ""

Thanks & regards
Shivanand K

-----Original Message-----
From: [email protected] <[email protected]> On Behalf Of Quirin Gylstorff via lists.cip-project.org
Sent: 20 July 2026 13:46
To: [email protected]
Subject: Re: [cip-dev] [isar-cip-core][PATCH v1 2/2] swupdate.cfg.tmpl: Add digest-provider option for signature verification



On 7/20/26 6:59 AM, Kunijadar Shivanand wrote:
> From: Shivanand Kunijadar <[email protected]>
> 
> This option is introduced from v2025.12 onwards in the SWUpdate package.
> It sets the crypto backend (mbedTLS) that the SWUpdate uses to verify 
> signed updates and compute digests when multiple provides are available.
> 
> Signed-off-by: Shivanand Kunijadar 
> <[email protected]>
> ---
>   .../files/{swupdate.cfg => swupdate.cfg.tmpl}             | 1 +
>   recipes-core/swupdate-config/swupdate-config_0.2.bb       | 8 +++++---
>   2 files changed, 6 insertions(+), 3 deletions(-)
>   rename recipes-core/swupdate-config/files/{swupdate.cfg => 
> swupdate.cfg.tmpl} (77%)
> 
> diff --git a/recipes-core/swupdate-config/files/swupdate.cfg 
> b/recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> similarity index 77%
> rename from recipes-core/swupdate-config/files/swupdate.cfg
> rename to recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> index 3e2b45c..44d8d04 100644
> --- a/recipes-core/swupdate-config/files/swupdate.cfg
> +++ b/recipes-core/swupdate-config/files/swupdate.cfg.tmpl
> @@ -2,4 +2,5 @@ globals :
>   {
>       bootloader = "ebg";
>       public-key-file = "/usr/share/swupdate-signing/swupdate-sign.crt"
here is semicolon missing.
> +    ${SWUPDATE_DIGEST_PROVIDER}
>   };
> diff --git a/recipes-core/swupdate-config/swupdate-config_0.2.bb 
> b/recipes-core/swupdate-config/swupdate-config_0.2.bb
> index b48e3d1..584706c 100644
> --- a/recipes-core/swupdate-config/swupdate-config_0.2.bb
> +++ b/recipes-core/swupdate-config/swupdate-config_0.2.bb
> @@ -19,12 +19,14 @@ DEBIAN_PROVIDES := "${PN}"
>   
>   PN .= "-${MACHINE}"
>   
> -SRC_URI = "file://swupdate.cfg \
> +SRC_URI = "file://swupdate.cfg.tmpl \
>              file://hwrevision.tmpl"
>   
> +SWUPDATE_DIGEST_PROVIDER ??= ""
> +SWUPDATE_DIGEST_PROVIDER:sid = "digest-provider = "pkcs#7mbedtls";"

It would be better to pin the version for the previous versions instead of sid.

Quirin

>   MACHINE_HW_VERSION ??= "cip-core-1.0"
> -TEMPLATE_FILES += "hwrevision.tmpl"
> -TEMPLATE_VARS += "MACHINE MACHINE_HW_VERSION"
> +TEMPLATE_FILES += "hwrevision.tmpl swupdate.cfg.tmpl"
> +TEMPLATE_VARS += "MACHINE MACHINE_HW_VERSION SWUPDATE_DIGEST_PROVIDER"
>   
>   do_install[cleandirs] = "${D}/etc/"
>   do_install() {
> 
> 
> 
> 
>