Tools: Don't add SHA256 digest to images when flash size detection is enabled

components/esptool_py/project_include.cmake

@@ -26,14 +26,14 @@ set(ESPFLASHSIZE ${CONFIG_ESPTOOLPY_FLASHSIZE})
 
 set(ESPTOOLPY_CHIP "${chip_model}")
 
-set(ELF2IMAGE_FLASH_OPTIONS
+set(esptool_elf2image_args
     --flash_mode ${ESPFLASHMODE}
     --flash_freq ${ESPFLASHFREQ}
     --flash_size ${ESPFLASHSIZE}
     )
 
 if(NOT BOOTLOADER_BUILD)
-    set(esptool_elf2image_args --elf-sha256-offset 0xb0)
+    list(APPEND esptool_elf2image_args --elf-sha256-offset 0xb0)
 endif()
 
 if(NOT CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION AND
@@ -59,9 +59,14 @@ if(min_rev)
 endif()
 
 if(CONFIG_ESPTOOLPY_FLASHSIZE_DETECT)
-    # Set ESPFLASHSIZE to 'detect' *after* ELF2IMAGE_FLASH_OPTIONS are generated,
+    # Set ESPFLASHSIZE to 'detect' *after* esptool_elf2image_args are generated,
     # as elf2image can't have 'detect' as an option...
     set(ESPFLASHSIZE detect)
+
+    # Flash size detection updates the image header which would invalidate the appended
+    # SHA256 digest. Therefore, a digest is not appended in that case.
+    # This argument requires esptool>=4.1.
+    set(esptool_elf2image_args --dont-append-digest)
 endif()
 
 if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
@@ -87,7 +92,7 @@ set(PROJECT_BIN "${elf_name}.bin")
 #
 if(CONFIG_APP_BUILD_GENERATE_BINARIES)
     add_custom_command(OUTPUT "${build_dir}/.bin_timestamp"
-        COMMAND ${ESPTOOLPY} elf2image ${ELF2IMAGE_FLASH_OPTIONS} ${esptool_elf2image_args}
+        COMMAND ${ESPTOOLPY} elf2image ${esptool_elf2image_args}
             -o "${build_dir}/${unsigned_project_binary}" "${elf_dir}/${elf}"
         COMMAND ${CMAKE_COMMAND} -E echo "Generated ${build_dir}/${unsigned_project_binary}"
         COMMAND ${CMAKE_COMMAND} -E md5sum "${build_dir}/${unsigned_project_binary}" > "${build_dir}/.bin_timestamp"