Allow for FIPS builds without ED25519 & MD5

[lealem47]

Goes along with wolfSSL/wolfssl#11144

[Copilot]

Pull request overview

This PR improves wolfCLU’s behavior (and test suite robustness) when building against wolfSSL configurations that omit MD5 and/or ED25519 (e.g., FIPS-focused builds), by returning NOT_COMPILED_IN with clearer messages and having tests skip appropriately instead of failing.

Changes:

• Added a shared Python test helper to detect NOT_COMPILED_IN via wolfCLU’s "Error returned: -174." reporting and updated select tests to skipTest() when algorithms are not present.
• Updated MD5-related setup paths (hash/dgst/bench/HMAC) to return NOT_COMPILED_IN and emit consistent “not compiled in” errors when NO_MD5 is enabled.
• Updated ED25519 verify/sign codepaths to return NOT_COMPILED_IN when ED25519 support is not compiled in.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/wolfclu_test.py	Adds NOT_COMPILED_IN constant and not_compiled_in() helper for skipping optional-algorithm tests.
tests/hash/hash-test.py	Skips MD5 hash test when MD5 isn’t compiled into wolfSSL.
tests/genkey_sign_ver/genkey-sign-ver-test.py	Skips optional key-type generation when wolfSSL reports NOT_COMPILED_IN (e.g., ED25519 omitted).
tests/bench/bench-test.py	Skips MD5 benchmark when MD5 isn’t compiled into wolfSSL.
src/tools/clu_funcs.c	Adds NO_MD5 handling in HMAC hash selection for MD5.
src/sign-verify/clu_verify.c	Returns/logs NOT_COMPILED_IN when ED25519 verify is unavailable; silences unused params in stubs.
src/sign-verify/clu_sign.c	Returns NOT_COMPILED_IN for ED25519 sign when unavailable; silences unused params in stub.
src/sign-verify/clu_dgst_setup.c	Returns/logs NOT_COMPILED_IN for -md5 selection when NO_MD5.
src/hash/clu_hash_setup.c	Returns/logs NOT_COMPILED_IN for md5 shortcut when NO_MD5.
src/benchmark/clu_bench_setup.c	Ensures --md5 is recognized even under NO_MD5 so a targeted NOT_COMPILED_IN error can be returned.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sebastian-carpenter]

MEDIUM-2: dgst MD5 tests not updated, so the NO_MD5 test run still fails [SUGGEST] (test)
File: tests/dgst/dgst-test.py:37-43,86-96,427,468-476
Function: DgstTest.test_verify_md5_rsa / test_sign_verify_all_hash_algs / HmacTest.test_hmac_vectors
Confidence: High

This commit changes exactly two MD5 code paths that tests/dgst/dgst-test.py exercises — clu_dgst_setup.c:622-629 (dgst -md5 now returns NOT_COMPILED_IN) and clu_funcs.c:1394 (wolfCLU_hmacHash MD5 now returns NOT_COMPILED_IN) — but the dgst suite was not given the new not_compiled_in() skip that bench-test.py, hash-test.py and genkey-sign-ver-test.py received. test_verify_md5_rsa and test_sign_verify_all_hash_algs (which appends "md5" whenever not is_fips()) and HmacTest.test_hmac_vectors (VECTORS["md5"]) are guarded only by is_fips(), never by MD5 availability. On a NO_MD5 build all three assert returncode == 0 against a command that now deliberately returns -174, so they fail. The commit's stated goal ("Allow for builds without ... MD5") is therefore not achieved for the dgst suite. test_fail_wrong_digest (dgst-test.py:74-79) would still pass, but for the wrong reason — it would be asserting the MD5-absent error rather than the digest-mismatch behaviour it is named for.

Code:
@unittest.skipIf(is_fips(), "MD5 not allowed in FIPS builds")
def test_verify_md5_rsa(self):
r = run_wolfssl("dgst", "-md5", "-verify", ...)
self.assertEqual(r.returncode, 0, r.stderr)

        algs = ["sha", "sha224", "sha256", "sha384", "sha512"]
        if not is_fips():
            algs.append("md5")

    VECTORS = {
        "md5":    "b4dcc86b987a882a22c04126bf38754b", ...

Recommendation: Apply the same not_compiled_in() skip to test_verify_md5_rsa, the md5 sub-test of test_sign_verify_all_hash_algs, and the md5 entry of HmacTest.test_hmac_vectors (and test_hmac_HEX_vectors if it carries an md5 vector), so a NO_MD5 build actually passes end to end.

[sebastian-carpenter]

MEDIUM-3: No CI configuration builds wolfSSL without MD5 or ED25519, so the new code paths are never compiled

• File: .github/workflows/ci.yml:18-24
• Function: N/A (CI matrix)
• Action: SUGGEST
• Tag: test
• Confidence: High

Description: The branch is titled "Allow for builds without ED25519 & MD5", but every entry in the CI matrix configures wolfSSL with MD5 and ED25519 present (--enable-wolfclu, --enable-all, etc.). Every #ifdef NO_MD5 / #else under HAVE_ED25519 branch added by this diff — clu_bench_setup.c:181-185, clu_hash_setup.c (eight sites), clu_dgst_setup.c:625-627, clu_funcs.c:1397-1400, clu_sign.c:717-724, clu_verify.c:182-185,836-844 — is therefore never preprocessed, never compiled, and never executed by CI. A syntax error, a missing include, or an unused-variable warning in any of these branches would not be caught, and the new not_compiled_in() skip logic in the Python tests is likewise never exercised. CI also passes CPPFLAGS="-DWC_SIG_MIN_HASH_TYPE=WC_HASH_TYPE_MD5", which further masks MD5-restricted builds.

Code:

        config:
          - '--enable-wolfclu'
          - '--enable-wolfclu --enable-crl --enable-dsa --enable-pkcs7'
          - '--enable-wolfclu --enable-smallstack'
          - '--enable-wolfclu --enable-experimental --enable-dilithium'
          - '--enable-wolfclu --enable-smallstack --enable-experimental --enable-dilithium'
          - '--enable-all'

Recommendation: Add at least one matrix entry that configures wolfSSL with --disable-md5 --disable-ed25519 (without the WC_SIG_MIN_HASH_TYPE override) so the branches this PR exists to add are actually compiled and the new test-skip logic is exercised.

---

LOW-7: clu_x509_sign.c NO_MD5 branch is now the only site not using NOT_COMPILED_IN

• File: src/x509/clu_x509_sign.c:1302-1308
• Function: wolfCLU_CertSign
• Action: NIT
• Tag: convention
• Confidence: High

Description: This diff standardises the "algorithm absent from the build" response on NOT_COMPILED_IN (clu_hash_setup.c x8, clu_bench_setup.c, clu_dgst_setup.c, clu_funcs.c, clu_sign.c, clu_verify.c) and builds a test helper on top of that code. clu_x509_sign.c has the structurally identical #ifndef NO_MD5 / #else guard around wolfSSL_EVP_md5() but still sets ret = WOLFCLU_FATAL_ERROR, so wolfssl ca -md5 ... on a NO_MD5 build reports Error returned: -1. and cannot be detected by not_compiled_in(). Not introduced by this diff, but it becomes the sole outlier from the convention the diff establishes.

Code:

        if (csign->hashType == WC_HASH_TYPE_MD5) {
        #ifndef NO_MD5
            md = wolfSSL_EVP_md5();
        #else
            wolfCLU_LogError("MD5 not compiled in");
            ret = WOLFCLU_FATAL_ERROR;
        #endif
        }

Recommendation: Fold this one-line change into the same PR so every "not compiled in" path reports the same code and the test helper works uniformly across subcommands.