image: check integrity in wolfBoot_verify_authenticity()

[rizlik]

invoking wolfBoot_verify_authenticity() without invoking wolfBoot_verify_integrity() led to the following scenario in hybrid signatures:

• image_hash is invoked on the image, and stored in the global digest
• keyslot_id_by_sha clobber the global digest when getting the secondary key
• secondary verification fails

Now wolfBoot_verify_authenticity() invokes wolfBoot_verify_integrity() if img->sha_hash is NULL or if img->sha_ok != 1.
After wolfBoot_verify_integrity() img->sha_hash points to the in-header stored SHA instead of the globals.

BREAKING CHANGE:

Now image that do not pass integrity can't be verified.
Now image that do not include the hash inside the header can't be authenticated.

[Copilot]

Pull request overview

This PR fixes a hybrid-signature verification failure caused by the global digest buffer being clobbered during secondary key lookup, by ensuring integrity verification is performed (and img->sha_hash is set to the stored header SHA) before authenticity checks proceed.

Changes:

• Update wolfBoot_verify_authenticity() to invoke wolfBoot_verify_integrity() when the image SHA hasn’t been verified (sha_hash == NULL or sha_ok != 1).
• Extend unit tests to cover the hybrid-signature direct-call scenario and to open images via wolfBoot_open_image() where needed.
• Add a dedicated unit-image-hybrid unit-test target to exercise hybrid verification paths with a larger header size.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/image.c	Ensures integrity verification is performed before authenticity verification when SHA state is missing/invalid, preventing hybrid verification from using a clobbered digest buffer.
tools/unit-tests/unit-image.c	Adds helpers and a hybrid-specific unit test that asserts the verified SHA is used consistently across hybrid verification steps.
tools/unit-tests/Makefile	Introduces unit-image-hybrid target and includes it in the unit-test run set.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.