feat(esp_image_verify): split image verification out of bootloader_support

components/esp_image_verify/private_include/bootloader_sha.h

@@ -0,0 +1,42 @@
+/*
+ * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+/* Provide a SHA256 API for image-verification code,
+   that can be used from bootloader or app code.
+   Use PSA APIs or include esp32/sha.h to calculate SHA256 in IDF apps.
+*/
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include "esp_err.h"
+#include "soc/soc_caps.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void *bootloader_sha256_handle_t;
+typedef bootloader_sha256_handle_t bootloader_sha_handle_t;
+
+bootloader_sha256_handle_t bootloader_sha256_start(void);
+
+void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len);
+
+void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest);
+
+#if SOC_SHA_SUPPORT_SHA512
+bootloader_sha_handle_t bootloader_sha512_start(bool is384);
+
+void bootloader_sha512_data(bootloader_sha_handle_t handle, const void *data, size_t data_len);
+
+void bootloader_sha512_finish(bootloader_sha_handle_t handle, uint8_t *digest);
+#endif /* SOC_SHA_SUPPORT_SHA512 */
+
+#ifdef __cplusplus
+}
+#endif

components/esp_image_verify/private_include/bootloader_signature.h

@@ -0,0 +1,38 @@
+/*
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "sdkconfig.h"
+#include <esp_err.h>
+#include <stdint.h>
+#include "rom/secure_boot.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_FULL >= 300
+
+#if CONFIG_SECURE_BOOT_V2_ENABLED || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+/** @brief Legacy function to verify RSA secure boot signature block for Secure Boot V2.
+ *
+ * @note This is kept for backward compatibility. It internally calls esp_secure_boot_verify_sbv2_signature_block.
+ *
+ * @param sig_block Pointer to RSA signature block data
+ * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
+ * @param verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
+ *
+ */
+esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
+
+#endif /* CONFIG_SECURE_BOOT_V2_ENABLED || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT */
+
+#endif
+
+#ifdef __cplusplus
+}
+#endif