From 2e918de239f4f2cfd20207131340eb1b299fa226 Mon Sep 17 00:00:00 2001
From: Daniele Lacamera <root@danielinux.net>
Date: Mon, 24 Aug 2026 18:00:54 +0200
Subject: [PATCH] F-9749: propagate the verify result from wolfBoot_start to
 the exit code

wolfBoot_start() in hal/library.c ended its exit: path with an
unconditional 'return 0;', so a rejected image (bad header, hash or
signature) still made the test-lib process exit 0. main() propagates
wolfBoot_start()'s return value, so the failure was only visible in
the printed "Failure" message, which the test-library workflow had to
grep for (TODO referencing PR #625).

Return ret, which carries the wolfBoot_verify_*() error on every path
that reaches exit: with a failure. The success path never returns:
do_boot() jumps to the firmware.

The test-library workflow drops the status-rewriting workaround and
asserts the non-zero exit code directly, keeping the "Failure"
message check as a diagnostic.

Verification:
- Built: make test-lib (host, library.config, ED25519/SHA256).
- Tested: local repro of the workflow flow: corrupt the last byte of
  a signed image; before the fix the process exited 0 while printing
  "Failure -1", after the fix it exits 255; a valid image still
  exits 0 with "Firmware Valid".
- Pitfalls: 'return ret' only changes the error paths; do_boot() does
  not return on success.
- Style: the cstyle-check.sh FMT flag on hal/library.c is present on
  the pre-change file as well (not introduced here).
- Message: F-9749: prefix, no co-author trailers.
---
 .github/workflows/test-library.yml | 12 ++----------
 hal/library.c                      |  4 +++-
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/test-library.yml b/.github/workflows/test-library.yml
index ee7417b7..5c33d2c6 100644
--- a/.github/workflows/test-library.yml
+++ b/.github/workflows/test-library.yml
@@ -174,16 +174,8 @@ jobs:
 
           echo "$output"
 
-          # TODO hal/library.c does not currently return an error code during failure
-          # Test only looks for the word "Failure"
-          # See https://github.com/wolfSSL/wolfBoot/pull/625
-
-          # If the tool printed "Failure", treat it as a failure regardless of exit code
-          if echo "$output" | grep -F "Failure" >/dev/null; then
-              status=1
-          fi
-
-          # Must have failed (non-zero exit)
+          # A rejected image must exit non-zero: wolfBoot_start() propagates
+          # the verify error to the process exit code
           if [ "$status" -eq 0 ]; then
             echo "Expected failure, but exit code was 0"
             exit 1
diff --git a/hal/library.c b/hal/library.c
index 465bed78..9bf5ef9f 100644
--- a/hal/library.c
+++ b/hal/library.c
@@ -165,7 +165,9 @@ int wolfBoot_start(void)
                         (int)os_image.signature_ok);
     }
 
-    return 0;
+    /* The error paths reach this point with ret < 0; propagate it so a
+     * rejected image does not look like a successful boot to the caller. */
+    return ret;
 }