[danielinux]

The key permission mask only restricts which partition ids a signing key may claim; it does not stop an image claiming a foreign partition from being staged in this core's partition and booted. The flash update path already rejects such images, but the A/B boot paths (RAM, hardware swap, disk) had no equivalent check: with a shared keystore, a key restricted to a secondary partition (e.g. the nRF5340 network core, WOLFBOOT_PART_ID=2) could sign an image that then boots on the primary core.

Add wolfBoot_image_part_matches(), which requires the image's claimed partition id to match HDR_IMG_TYPE_APP.

• unit test cases.

Reported by @john-kearney

zd 22699

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #952

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .gitignore
Coverage: 5 of 12 in-scope changed file(s) opened by the reviewer; not opened: include/image.h, tools/unit-tests/unit-update-disk-confirm.c, tools/unit-tests/unit-update-disk-fit.c, tools/unit-tests/unit-update-disk-fsp.c, tools/unit-tests/unit-update-disk-golden.c, tools/unit-tests/unit-update-disk-oob.c, tools/unit-tests/unit-update-disk.c

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #952

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .gitignore
Coverage: 1 of 2 in-scope changed file(s) opened by the reviewer; not opened: tools/unit-tests/unit-update-disk-fs.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.