# ZephCore Sysbuild Configuration
# Enables the MCUboot bootloader whenever --sysbuild is passed. Used by the
# ESP32-S3/C-series release builds (companion and repeater: MCUboot @ 0x0, app
# @ 0x10000) and by any build with wifi_ota.conf. Classic ESP32, nRF52, nRF54L,
# MG24 and STM32WL builds do not use --sysbuild.

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

# Explicit since Zephyr 4.5: 51ef282b5f1 moved Espressif sysbuild to the generic
# MCUboot defaults, whose signature type is RSA.  That silently turned the
# bootloader into an RSA-2048 verifier keyed to MCUboot's public development
# key -- no real security, ~19 KB of mbedTLS/PSA that overflowed the 64 KB
# MCUboot slot on several boards (the app written at 0x10000 then overwrites
# the bootloader's tail), and a bootloader that rejects the hash-only images
# every deployed ESP32 node and WiFi-OTA update uses.  NONE = hash check only,
# exactly what v4.4 built.  Moving to real signing (own key) is a separate
# decision with OTA consequences.
SB_CONFIG_BOOT_SIGNATURE_TYPE_NONE=y