How to resolve a situation where an invalid firmware has been marked for update

[hakanlundvall]

Suppose the firmware loads a new image to the update partition and then marks it for update using update_trigger(), but the image is corrupt so that the integrity or authenticity check fails. To me it seems we end up in a panic and the update trigger is still there so the same thing happens on every boot attempt.

rustBoot/boards/update/src/update/update_flash.rs

Lines 161 to 177 in 8437fd2

	// Check the first sector to detect an interrupted update.
	if updt_part.get_flags(0).is_err() || updt_part.get_flags(0)?.has_new_flag() {
	let update_type = updt.get_image_type()?;
	// In the event that this is a new update, perform the required checks on the update
	// before starting the swap.
	if ((update_type & HDR_MASK_LOWBYTE) != HDR_IMG_TYPE_APP)
	|| ((update_type & HDR_MASK_HIGHBYTE) != HDR_IMG_TYPE_AUTH)
	{
	return Err(RustbootError::ECCError);
	}
	if (!updt_part.hdr_ok
	|| updt.verify_integrity::<SHA256_DIGEST_SIZE>().is_err()
	|| updt.verify_authenticity::<HDR_IMG_TYPE_AUTH>().is_err())
	{
	panic!("firmware authentication failed");
	}
	}

The only way out seems to be to connect the debug port and clear the update partition. Or am I missing something?