feat(esp_image_verify): split image verification out of bootloader_support

components/esp_partition/CMakeLists.txt

@@ -29,7 +29,7 @@ else()
     set(srcs "partition.c")
     set(priv_reqs esp_system spi_flash partition_table efuse)
     set(reqs esp_blockdev)
-    set(private_include_dirs)
+    set(private_include_dirs "")
 
     idf_build_get_property(build_dir BUILD_DIR)
     idf_build_get_property(target IDF_TARGET)
@@ -41,7 +41,7 @@ else()
         idf_component_get_property(bootloader_support_dir bootloader_support COMPONENT_DIR)
         set(private_include_dirs ${bootloader_support_dir}/include)
     else()
-        list(APPEND priv_reqs bootloader_support app_update)
+        list(APPEND priv_reqs bootloader_support)
         list(APPEND srcs "partition_target.c")
     endif()
 

components/esp_partition/include/esp_partition.h

@@ -535,6 +535,10 @@ void esp_partition_munmap(esp_partition_mmap_handle_t handle);
  *          - ESP_ERR_NO_MEM: Cannot allocate memory for sha256 operation.
  *          - ESP_ERR_IMAGE_INVALID: App partition doesn't contain a valid app image.
  *          - ESP_FAIL: An allocation error occurred.
+ *
+ * @note Requires the esp_image_verify component in the build (apps using OTA get
+ *       it through app_update). Calling it without that component fails at link
+ *       time with an undefined reference.
  */
 esp_err_t esp_partition_get_sha256(const esp_partition_t* partition, uint8_t* sha_256);
 

components/esp_partition/include/esp_private/esp_partition_utils.h

@@ -0,0 +1,27 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "esp_partition.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Find the APP partition containing the currently executing firmware.
+ *
+ * Private helper shared by esp_partition and app_update; application code
+ * should prefer esp_ota_get_running_partition() (app_update). The result is
+ * cached after the first lookup.
+ *
+ * @return Running APP partition
+ */
+const esp_partition_t *esp_partition_get_running_partition(void);
+
+#ifdef __cplusplus
+}
+#endif

components/esp_partition/partition_target.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -19,7 +19,7 @@
 #include "esp_rom_md5.h"
 #include "spi_flash_mmap.h"
 #include "bootloader_common.h"
-#include "esp_ota_ops.h"
+#include "esp_private/esp_partition_utils.h"
 
 #define HASH_LEN 32 /* SHA-256 digest length */
 
@@ -189,7 +189,13 @@ void esp_partition_munmap(esp_partition_mmap_handle_t handle)
 
 esp_err_t esp_partition_get_sha256(const esp_partition_t *partition, uint8_t *sha_256)
 {
-    return bootloader_common_get_sha256_of_partition(partition->address, partition->size, partition->type, sha_256);
+    /* Single shared implementation lives in bootloader_common.
+       Inline its body here once that API is removed. */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+    return bootloader_common_get_sha256_of_partition(partition->address, partition->size,
+                                                     partition->type, sha_256);
+#pragma GCC diagnostic pop
 }
 
 bool esp_partition_check_identity(const esp_partition_t *partition_1, const esp_partition_t *partition_2)
@@ -224,12 +230,43 @@ bool esp_partition_is_flash_region_writable(size_t addr, size_t size)
     return true;
 }
 
+const esp_partition_t *esp_partition_get_running_partition(void)
+{
+    static const esp_partition_t *s_running_partition = NULL;
+
+    if (s_running_partition != NULL) {
+        return s_running_partition;
+    }
+    size_t phys_offs = spi_flash_cache2phys(esp_partition_get_running_partition);
+
+    assert(phys_offs != SPI_FLASH_CACHE2PHYS_FAIL); /* indicates cache2phys lookup is buggy */
+    if (phys_offs == SPI_FLASH_CACHE2PHYS_FAIL) {
+        abort(); /* stay fatal when asserts are compiled out */
+    }
+
+    esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_APP,
+                                                     ESP_PARTITION_SUBTYPE_ANY, NULL);
+    assert(it != NULL); /* has to be at least one app partition */
+
+    while (it != NULL) {
+        const esp_partition_t *p = esp_partition_get(it);
+        if (phys_offs >= p->address && phys_offs < p->address + p->size) {
+            esp_partition_iterator_release(it);
+            s_running_partition = p;
+            return p;
+        }
+        it = esp_partition_next(it);
+    }
+
+    abort(); /* Partition table is invalid or corrupt */
+}
+
 bool esp_partition_main_flash_region_safe(size_t addr, size_t size)
 {
     if (addr <= ESP_PARTITION_TABLE_OFFSET + ESP_PARTITION_TABLE_MAX_LEN) {
         return false;
     }
-    const esp_partition_t *p = esp_ota_get_running_partition();
+    const esp_partition_t *p = esp_partition_get_running_partition();
     if (addr >= p->address && addr < p->address + p->size) {
         return false;
     }