soc: st: stm32: add '-align' flag for signing tool v2.21.0+

Starting in v2.21.0, the STM32 signing tool ('STM32_SigningTool_CLI')
stopped automatically adding padding bytes at the beginning of the
payload to align it to the 0x400 offset. To restore this behavior, the
'-align' flag must be passed to the signing tool post-build command.

This commit checks for signing tool version v2.21.0 or higher and
appends the '-align' flag to the post-build signing command.

Fixes #99456

Signed-off-by: Chris Wilson <chris@binho.io>

Author: cdwilson

soc/st/stm32/stm32n6x/CMakeLists.txt

@@ -28,20 +28,52 @@ if(NOT CONFIG_BOOTLOADER_MCUBOOT)
     set(SIGNING_TOOL STM32_SigningTool_CLI)
   endif()
 
-  find_file(SIGNING_TOOL_FIND ${SIGNING_TOOL})
+  find_program(SIGNING_TOOL_FIND ${SIGNING_TOOL})
   if(SIGNING_TOOL_FIND STREQUAL SIGNING_TOOL_FIND-NOTFOUND)
     message(WARNING "
     Signing Image tool (${SIGNING_TOOL}) is not available.
     Signed image will not be generated.
     You won't be able to run application on the board.
     Refer to board documentation for more information")
   else()
-    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
-      COMMAND ${SIGNING_TOOL}
+    set(SIGNING_TOOL_MIN_VERSION "2.21.0")
+    set(SIGNING_TOOL_VERSION_REGEX "v([0-9]+[.][0-9]+[.][0-9]+)")
+
+    execute_process(
+      COMMAND ${SIGNING_TOOL_FIND} --version
+      OUTPUT_VARIABLE version
+      RESULT_VARIABLE result
+    )
+
+    set(SIGNING_TOOL_ARGS
       -in ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.bin
       -nk -t fsbl -hv 2.3 --silent
       -o ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
       -dump ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
+    )
+
+    if(result EQUAL 0 AND version MATCHES ${SIGNING_TOOL_VERSION_REGEX})
+      set(SIGNING_TOOL_VERSION ${CMAKE_MATCH_1})
+
+      if(SIGNING_TOOL_VERSION VERSION_GREATER_EQUAL SIGNING_TOOL_MIN_VERSION)
+        list(APPEND SIGNING_TOOL_ARGS -align)
+
+        message(STATUS
+        "Found ${SIGNING_TOOL} version v${SIGNING_TOOL_VERSION}, "
+        "appending \"-align\" flag to post-build signing command "
+        "(applicable only with header v2.3 for MCUs, starting from "
+        "version v${SIGNING_TOOL_MIN_VERSION})"
+        )
+      endif()
+    else()
+      message(FATAL_ERROR
+      "Unable to determine ${SIGNING_TOOL} version (expected match to "
+      "${SIGNING_TOOL_VERSION_REGEX} regex)"
+      )
+    endif()
+
+    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
+      COMMAND ${SIGNING_TOOL} ${SIGNING_TOOL_ARGS}
       WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
     )