[General] ESP32S3 OTA fails due to not multiple of 16 bytes

[andrew-elder]

After AWS code signing the firmware image is no longer a multiple of 16 bytes

If I upload this file to S3

-rw-rw-r-- 1 ???? ??? 1633824 Nov  3 10:56  0.9.59.bin

on AWS and have AWS sign it, I end up with

-rw-rw-r-- 1 ???? ???? 2178621 Nov  4 14:04 3e6ca106-302b-491a-af76-c4de303f7d42

Obviously 2178621 is not an exact multiple of 16 bytes - which is an ESP32S3 requirement when storing the OTA image to encrypted flash. The resulting error looks like:

E (265091) esp_ota_ops: Size should be 16byte aligned for flash encryption case
E (265099) OTA: Couldn't flash at the offset 2174976

I have also read this issue that describes a related problem https://github.com/aws/amazon-freertos/issues/3215.

Is there a code signing alignment setting I should be using?

On a related note, why does code signing cause the file size increase from 1.6M to 2.1M?