The resulting base image (that generated for the recipe which inherits swupd-image) and the os-core bundle contents should be copied from the virtual mega image's rootfs in order to ensure that fully populated versions of any files which undergo post-processing during rootfs/image construction (i.e. /etc/passwd) are included.
A change has been pushed to meta-swupd to implement populating the base image and bundle contents from the mega-image's rootfs: http://git.yoctoproject.org/cgit/cgit.cgi/meta-swupd/commit/?id=5cfb2c0aadc0a9175347e76981e327c6fbbf053c