fix(secure_boot): Fix SB verification failure when sig block and key digest mismatch

- Secure boot V2 verification failed when multiple keys are used to sign the bootloader
  and the application is signed with a key other than the first key that is used to
  sign the bootloader.
- The issue was introduced as a regression from the commit `ff16ce43`.
- Added a QEMU test for recreating the issue.
- Made SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT independent of SECURE_BOOT_BUILD_SIGNED_BINARIES.

tools/test_apps/security/secure_boot/main/CMakeLists.txt

@@ -7,3 +7,38 @@ endif()
 
 idf_component_register(SRCS "${main_src}" INCLUDE_DIRS ".")
 target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
+
+if(CONFIG_EXAMPLE_TARGET_QEMU)
+    set(bootloader_unsigned_bin "bootloader-unsigned.bin")
+    set(app_unsigned_bin "${PROJECT_BIN}-unsigned.bin")
+
+    add_custom_target(sign_bootloader ALL
+        COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_BINARY_DIR}/bootloader/bootloader.bin"
+        "${CMAKE_BINARY_DIR}/bootloader/${bootloader_unsigned_bin}"
+        COMMAND ${ESPSECUREPY} sign_data --version 2 --keyfile
+        ${PROJECT_DIR}/test/secure_boot_signing_key0.pem
+        ${PROJECT_DIR}/test/secure_boot_signing_key1.pem
+        ${PROJECT_DIR}/test/secure_boot_signing_key2.pem
+        -o "${CMAKE_BINARY_DIR}/bootloader/bootloader.bin"
+        "${CMAKE_BINARY_DIR}/bootloader/${bootloader_unsigned_bin}"
+        COMMAND ${CMAKE_COMMAND} -E echo "Generated signed binary image ${CMAKE_BINARY_DIR}/bootloader/bootloader.bin"
+        "from ${CMAKE_BINARY_DIR}/bootloader/${bootloader_unsigned_bin}"
+        VERBATIM
+        COMMENT "Generated the test-specific signed bootloader")
+
+    add_dependencies(sign_bootloader bootloader)
+
+    add_custom_target(sign_app ALL
+        COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_BINARY_DIR}/${PROJECT_BIN}"
+        "${CMAKE_BINARY_DIR}/${app_unsigned_bin}"
+        COMMAND ${ESPSECUREPY} sign_data --version 2 --keyfile
+        ${PROJECT_DIR}/test/secure_boot_signing_key1.pem
+        -o "${CMAKE_BINARY_DIR}/${PROJECT_BIN}"
+        "${CMAKE_BINARY_DIR}/${app_unsigned_bin}"
+        COMMAND ${CMAKE_COMMAND} -E echo "Generated signed binary image ${CMAKE_BINARY_DIR}/${PROJECT_BIN}"
+        "from ${CMAKE_BINARY_DIR}/${app_unsigned_bin}"
+        VERBATIM
+        COMMENT "Generated the test-specific signed application")
+
+    add_dependencies(sign_app app)
+endif()

tools/test_apps/security/secure_boot/main/Kconfig.projbuild

@@ -0,0 +1,9 @@
+menu "Example Configuration"
+
+    config EXAMPLE_TARGET_QEMU
+        bool "Run the example tests for target QEMU"
+        default n
+        help
+            Run the example tests for target QEMU
+
+endmenu

tools/test_apps/security/secure_boot/main/secure_boot_main.c

@@ -76,4 +76,13 @@ static void example_secure_boot_status(void)
     } else {
         ESP_LOGI(TAG, "Secure Boot not enabled. Enable Secure Boot in menuconfig, build & flash again.");
     }
+
+#if CONFIG_EXAMPLE_TARGET_QEMU
+    for (int i = 5; i >= 0; i--) {
+        ESP_LOGI(TAG, "Restarting in %d seconds...", i);
+        vTaskDelay(1000 / portTICK_PERIOD_MS);
+    }
+    ESP_LOGI(TAG, "Restarting now.");
+    esp_restart();
+#endif /* CONFIG_EXAMPLE_TARGET_QEMU */
 }