[meta-swupdate][PATCH] swupdate-common: add SWUPDATE_CMS_MD to select the CMS digest

[Ayoub Zaki]

From: Ayoub Zaki <ayoub...@googlemail.com>

The CMS signing command "openssl cms -sign" without an explicit -md
thus leaving openssl to pick the signing key's default digest.
Keys that advertise no default digest cannot be used this way: openssl
aborts with "no default digest". This is the case for the post-quantum
ML-DSA keys supported since OpenSSL 3.5 + which are hashless
and require the digest to be explicitly supplied.

Add an optional SWUPDATE_CMS_MD variable when set is passed to
openssl cms -sign as -md <value> (e.g: sha256, sha512).
When unset the previous behaviour is preserved.

Signed-off-by: Ayoub Zaki <ayoub...@embetrix.com>
---
README | 6 ++++++
classes-recipe/swupdate-common.bbclass | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 96dfbf2..f28bbce 100644
--- a/README
+++ b/README
@@ -66,6 +66,12 @@ There are 3 signing mechanisms supported by meta-swupdate at the moment:

* (Optional) Set `SWUPDATE_CMS_EXTRA_CERTS` to a space delimited list of intermediate certificate files

+ * (Optional) Set `SWUPDATE_CMS_MD` to the message digest algorithm passed to
+ `openssl cms -sign` via `-md` (e.g. `sha256`, `sha512`). When unset, openssl
+ picks the signing key's default digest. This is required for signing keys
+ that have no default digest such as ML-DSA where openssl otherwise fails
+ with "no default digest".
+
3. Custom signing tool:

* Set variable: `SWUPDATE_SIGNING = "CUSTOM"`
diff --git a/classes-recipe/swupdate-common.bbclass b/classes-recipe/swupdate-common.bbclass
index 0fbcd20..1359e09 100644
--- a/classes-recipe/swupdate-common.bbclass
+++ b/classes-recipe/swupdate-common.bbclass
@@ -228,8 +228,10 @@ def prepare_sw_description(d):
bb.fatal("SWUPDATE_CMS_KEY isn't set")
if not os.path.exists(cms_key):
bb.fatal("SWUPDATE_CMS_KEY %s doesn't exist" % (cms_key))
+ cms_md = d.getVar('SWUPDATE_CMS_MD')
+ md_args = ["-md", cms_md] if cms_md else []
signcmd = ["openssl", "cms", "-sign", "-in", sw_desc, "-out", sw_desc_sig, "-signer", cms_cert, "-inkey", cms_key] + \
- ["-outform", "DER", "-nosmimecap", "-binary"] + \
+ ["-outform", "DER", "-nosmimecap", "-binary"] + md_args + \
get_pwd_file_args(d, 'SWUPDATE_PASSWORD_FILE') + \
get_certfile_args(d)
else:
--
2.43.0

[Ayoub Zaki]

From: Stefano Babic <stefan...@swupdate.org>

Signed-off-by: Stefano Babic <stefan...@swupdate.org>

Signed-off-by: Ayoub Zaki <ayoub...@embetrix.com>
---

recipes-support/swupdate/swupdate_2026.05.1.bb | 3 +++
recipes-support/swupdate/swupdate_2026.05.bb | 3 ---
2 files changed, 3 insertions(+), 3 deletions(-)
create mode 100644 recipes-support/swupdate/swupdate_2026.05.1.bb
delete mode 100644 recipes-support/swupdate/swupdate_2026.05.bb

diff --git a/recipes-support/swupdate/swupdate_2026.05.1.bb b/recipes-support/swupdate/swupdate_2026.05.1.bb
new file mode 100644
index 0000000..35f3383
--- /dev/null
+++ b/recipes-support/swupdate/swupdate_2026.05.1.bb
@@ -0,0 +1,3 @@
+SRCBRANCH = "master"
+SRCREV = "9000ecb52677da7d9676a61b729bab57dba99674"
+require swupdate.inc
diff --git a/recipes-support/swupdate/swupdate_2026.05.bb b/recipes-support/swupdate/swupdate_2026.05.bb
deleted file mode 100644
index b80e0f3..0000000
--- a/recipes-support/swupdate/swupdate_2026.05.bb
+++ /dev/null
@@ -1,3 +0,0 @@
-SRCBRANCH = "master"
-SRCREV = "602edf8e57f940791034096c9e24206097b4b7a6"
-require swupdate.inc
--
2.43.0

[ayoub...@googlemail.com]

Ping, any update on this ?

[Stefano Babic]

Hi Ayoub,

On 7/6/26 17:06, 'ayoub...@googlemail.com' via swupdate wrote:
> Ping, any update on this ?
>

Sorrs for late: applied to -master, -wrynose and -scarthgap, thanks !

Best regards,
Stefano

> --
> You received this message because you are subscribed to the Google
> Groups "swupdate" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to swupdate+u...@googlegroups.com
> <mailto:swupdate+u...@googlegroups.com>.
> To view this discussion visit https://groups.google.com/d/msgid/
> swupdate/3aaa9b75-70bf-484d-8b7a-8c1d287641bdn%40googlegroups.com
> <https://groups.google.com/d/msgid/
> swupdate/3aaa9b75-70bf-484d-8b7a-8c1d287641bdn%40googlegroups.com?
> utm_medium=email&utm_source=footer>.

--
_______________________________________________________________________
Nabla Software Engineering GmbH
Hirschstr. 111A | 86156 Augsburg | Tel: +49 821 45592596
Geschäftsführer : Stefano Babic | HRB 40522 Augsburg
E-Mail: sba...@nabladev.com