From 973f93b2ec0a9c9a973e199b46c22dfc23242211 Mon Sep 17 00:00:00 2001
From: Ahmad Bin Shafqat <61423804+ahmadbinshafqat@users.noreply.github.com>
Date: Thu, 3 Sep 2026 16:10:07 +0500
Subject: [PATCH 1/2] Update test_sign_image.py

---
 tests/unit/test_sign_image.py | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/tests/unit/test_sign_image.py b/tests/unit/test_sign_image.py
index 8884115..d00b287 100644
--- a/tests/unit/test_sign_image.py
+++ b/tests/unit/test_sign_image.py
@@ -182,6 +182,44 @@ def test_verify_rejects_a_signed_image_under_the_wrong_key(signed_image, tmp_pat
     assert "does not verify" in r.stderr
 
 
+
+def _pack_unsigned(tmp_path, payload=None):
+    """Pack a raw payload into an unsigned .eimg via imgpack.py."""
+    payload = payload if payload is not None else b"\xA5" * 512
+    (tmp_path / "fw.bin").write_bytes(payload)
+    r = _run(TOOLS / "imgpack.py",
+             "--input", tmp_path / "fw.bin", "--output", tmp_path / "fw.eimg",
+             "--load-addr", "0x08010000", "--entry-addr", "0x08010100",
+             "--version", "1.0.0")
+    assert r.returncode == 0, r.stderr
+    return tmp_path / "fw.eimg"
+
+
+def test_sha256_method_sets_the_integrity_flag(tmp_path):
+    """--method sha256 must set EOS_IMG_FLAG_HASH_SHA256."""
+    image = _pack_unsigned(tmp_path)
+    r = _run(TOOLS / "sign_image.py", "--image", image, "--method", "sha256")
+    assert r.returncode == 0, r.stderr
+
+    data = image.read_bytes()
+    flags = struct.unpack_from("<I", data, FLAGS_OFFSET)[0]
+    assert flags & IMG_FLAG_HASH_SHA256, (
+        "SHA-256 signing left EOS_IMG_FLAG_HASH_SHA256 unset")
+    assert data[SIG_TYPE_OFFSET] == 2  # SIG_SHA256
+
+
+def test_sha256_method_verifies_as_sha256(tmp_path):
+    """--verify must take the SHA-256 path after --method sha256."""
+    image = _pack_unsigned(tmp_path, bytes(range(256)) * 4)
+    r = _run(TOOLS / "sign_image.py", "--image", image, "--method", "sha256")
+    assert r.returncode == 0, r.stderr
+
+    r = _run(TOOLS / "sign_image.py", "--image", image, "--verify")
+    assert r.returncode == 0, f"{r.stdout}\n{r.stderr}"
+    assert "SHA-256:        OK" in r.stdout
+    assert "CRC32:" not in r.stdout
+
+
 def test_verify_requires_a_signature_when_a_key_is_given(tmp_path):
     """An unsigned image must not pass --verify just because its CRC is fine."""
     (tmp_path / "fw.bin").write_bytes(b"\xA5" * 512)

From 720e098776541af6e9eb0ab19442dc3c1a4ecc35 Mon Sep 17 00:00:00 2001
From: Ahmad Bin Shafqat <61423804+ahmadbinshafqat@users.noreply.github.com>
Date: Thu, 3 Sep 2026 16:10:33 +0500
Subject: [PATCH 2/2] Update sign_image.py

---
 tools/sign_image.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/sign_image.py b/tools/sign_image.py
index 3671cd6..84e8e52 100644
--- a/tools/sign_image.py
+++ b/tools/sign_image.py
@@ -112,6 +112,10 @@ def sign_sha256(image_path: Path):
     data[SIG_TYPE_OFFSET] = SIG_SHA256
     data[SIG_LEN_OFFSET] = 0
 
+    flags = struct.unpack_from('<I', data, FLAGS_OFFSET)[0]
+    flags |= IMG_FLAG_HASH_SHA256
+    struct.pack_into('<I', data, FLAGS_OFFSET, flags)
+
     image_path.write_bytes(bytes(data))
     print(f"SHA-256 hash applied: {sha.hex()}")