# ZephCore Sysbuild Configuration
# Enables MCUboot bootloader for ESP32 OTA firmware updates.
# Only used when building with --sysbuild flag (ESP32 repeater builds).
# nRF52/nRF54L/MG24 builds do NOT use --sysbuild and are unaffected.

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

# Explicit since Zephyr 4.5: 51ef282b5f1 moved Espressif sysbuild to the generic
# MCUboot defaults, whose signature type is RSA.  That silently turned the
# bootloader into an RSA-2048 verifier keyed to MCUboot's public development
# key -- no real security, ~19 KB of mbedTLS/PSA that overflowed the 64 KB
# MCUboot slot on several boards (the app written at 0x10000 then overwrites
# the bootloader's tail), and a bootloader that rejects the hash-only images
# every deployed ESP32 node and WiFi-OTA update uses.  NONE = hash check only,
# exactly what v4.4 built.  Moving to real signing (own key) is a separate
# decision with OTA consequences.
SB_CONFIG_BOOT_SIGNATURE_TYPE_NONE=y