Use pkg config for wolfSSL discovery

[aidangarske]

Addresses #39 and #35

[Copilot]

🟡 Changes recommended

The Makefile’s pkg-config probes pass an unquoted module name into $(shell ...), enabling shell injection/misparsing (CWE-78), and the new macOS README snippet should reflect the GNU make requirement to avoid a broken setup path.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates wolfCOSE’s build system to discover system-installed wolfSSL via pkg-config (improving Homebrew/macOS installs) while preserving explicit override paths for cross/custom builds, and adds a self-check target to validate the discovery logic.

Changes:

• Teach the Makefile to prefer pkg-config (wolfssl.pc) for WOLFSSL_CFLAGS/WOLFSSL_LIBS, with a /usr/local fallback and override knobs.
• Add a build-config hash sentinel to force recompilation of core objects when effective build configuration changes.
• Add scripts/test_pkg_config.sh plus a make pkg-config-test target, and document the feature in README/ChangeLog.

File summaries

File	Description
scripts/test_pkg_config.sh	Adds a fixture-based test script to validate pkg-config detection, overrides, and rebuild behavior without requiring wolfSSL installed.
README.md	Documents system-installed wolfSSL discovery and the new pkg-config-test build target.
Makefile	Implements pkg-config-based discovery, introduces LDLIBS, adds config-change rebuild sentinel, and wires in the pkg-config test target.
ChangeLog.md	Notes the new pkg-config-based discovery behavior for system-installed wolfSSL.
.gitignore	Ignores the new .wolfcose-build-config sentinel file.

Review details

Suppressed comments (1)

Makefile:30

• pkg-config --cflags/--libs is invoked with an unquoted $(WOLFSSL_PACKAGE) value, which can lead to shell injection (CWE-78) or incorrect parsing if the module name contains special characters. Quote the module name in both calls.

WOLFSSL_CFLAGS ?= $(shell $(PKG_CONFIG) --cflags $(WOLFSSL_PACKAGE) 2>/dev/null)
WOLFSSL_LIBS   ?= $(shell $(PKG_CONFIG) --libs $(WOLFSSL_PACKAGE) 2>/dev/null)

• Files reviewed: 4/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #69

No scan targets match the changed files in this PR. Review skipped.