swupdate-common: add SWUPDATE_CMS_MD to select the CMS digest

The CMS signing command "openssl cms -sign" without an explicit -md
thus leaving openssl to pick the signing key's default digest.
Keys that advertise no default digest cannot be used this way: openssl
aborts with "no default digest". This is the case for the post-quantum
ML-DSA keys supported since OpenSSL 3.5 + which are hashless
and require the digest to be explicitly supplied.

Add an optional SWUPDATE_CMS_MD variable when set is passed to
openssl cms -sign as -md <value> (e.g: sha256, sha512).
When unset the previous behaviour is preserved.

Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>

README

@@ -64,6 +64,12 @@ There are 3 signing mechanisms supported by meta-swupdate at the moment:
 
   * (Optional) Set `SWUPDATE_CMS_EXTRA_CERTS` to a space delimited list of intermediate certificate files
 
+  * (Optional) Set `SWUPDATE_CMS_MD` to the message digest algorithm passed to
+    `openssl cms -sign` via `-md` (e.g. `sha256`, `sha512`). When unset, openssl
+    picks the signing key's default digest. This is required for signing keys
+    that have no default digest such as ML-DSA where openssl otherwise fails
+    with "no default digest".
+
 3. Custom signing tool:
 
   * Set variable: `SWUPDATE_SIGNING = "CUSTOM"`

classes-recipe/swupdate-common.bbclass

@@ -216,8 +216,10 @@ def prepare_sw_description(d):
                 bb.fatal("SWUPDATE_CMS_KEY isn't set")
             if not os.path.exists(cms_key):
                 bb.fatal("SWUPDATE_CMS_KEY %s doesn't exist" % (cms_key))
+            cms_md = d.getVar('SWUPDATE_CMS_MD')
+            md_args = ["-md", cms_md] if cms_md else []
             signcmd = ["openssl", "cms", "-sign", "-in", sw_desc, "-out", sw_desc_sig, "-signer", cms_cert, "-inkey", cms_key] + \
-                        ["-outform", "DER", "-nosmimecap", "-binary"] + \
+                        ["-outform", "DER", "-nosmimecap", "-binary"] + md_args + \
                         get_pwd_file_args(d, 'SWUPDATE_PASSWORD_FILE') + \
                         get_certfile_args(d)
         else: