[aidangarske]

• Follow up Add SPM-mediated PKCS#11 and TPM 2.0 interfaces #76 with smaller default TPM2 and PKCS11 builds.
• Preserve default operations, Secure state and production PIN protection.
• Test PSA, TPM2 and PKCS11 with native/HSM engines and default/full profiles.
• Keep all six matched default builds within 8 KiB of same-engine PSA.
• Add ASN codec and full storage-buffer range regressions.
• Fix manual nightly selection and M33MU/C99 concurrency.
• Validation: local tests and all 297 CI jobs passed.

Current wolfTrust-Dev2 size change

Engine	Interface	Original build	Before this follow-up	Now	Original → now decrease
Native	TPM2	207,014	132,000	129,760	37.32%
Native	PKCS#11	204,276	136,552	134,312	34.25%
HSM	TPM2	266,364	176,532	169,520	36.36%
HSM	PKCS#11	244,008	175,532	169,260	30.63%

With PR current size numbers

Engine	Interface	Secure image	Application	Total	Above base PSA
Native	PSA	94,400	33,488	127,888	Baseline
Native	TPM2	114,284	15,476	129,760	+1,872 (+1.46%)
Native	PKCS#11	123,260	11,052	134,312	+6,424 (+5.02%)
HSM	PSA	118,204	43,156	161,360	Baseline
HSM	TPM2	154,044	15,476	169,520	+8,160 (+5.06%)
HSM	PKCS#11	158,208	11,052	169,260	+7,900 (+4.90%)

[Copilot]

🔵 Needs a closer look

Missing pinned wolfHSM sources prevent dependency-backed validation of the generated callback’s preprocessor changes, ABI consistency, and TPM/PIN crypto fallback behavior.

No open issues 🎉

What changed in this PR

This follow-up to #76 reduces wolfTrust’s default TPM2 and PKCS#11 footprint while retaining required crypto primitives and production PIN protection.

Changes:

• Trim unused provider crypto features, HSM callbacks, and disabled PKCS#11 dispatch paths.
• Add a six-build footprint gate enforcing an 8 KiB overhead ceiling against same-engine PSA.
• Add ASN codec and storage-buffer regressions, and fix manual nightly selection and reusable-workflow concurrency.

File	Description
tools/​measure_interface_footprint.sh	Reject test PIN settings and record dependency revisions.
tools/​crypto_profile.py	Generate profile-specific HSM callbacks and crypto flags.
tools/​check_interface_footprint.py	Validate matched measurements and enforce flash limits.
tests/​target/​lib/​scenario_matrix.py	Check nightly selection and workflow concurrency groups.
tests/​host/​psa_storage_client/​main.c	Test full destination bounds and storage dispatch counts.
tests/​host/​Makefile	Register the ASN codec suite.
tests/​host/​crypto_profile/​test_generator.py	Cover footprint validation, profile settings, build dependencies, and CI guards.
tests/​host/​asn_codec/​Makefile	Build and cross-test both ASN codecs.
tests/​host/​asn_codec/​main.c	Test ECC DER round trips, malformed inputs, and codec interoperability.
src/​services/​wolfhsm/​runner/​user_settings.h	Narrow crypto features and select the basic TPM ASN codec.
src/​pkcs11/​pkcs11_provider.c	Add profile guards to optional dispatch paths.
mk/​crypto-profile.mk	Track the generated HSM callback source.
mk/​common.mk	Compile generated callbacks for TPM and PKCS#11 providers.
docs/​Testing.md	Document storage regressions and footprint enforcement.
docs/​Interface-Footprint.md	Update measurements, reproduction steps, and validation scope.
docs/​Crypto-Profiles.md	Explain profile-dependent crypto and callback reductions.
.github/​workflows/​README.md	Document the footprint gate and clarify Secure TPM placement.
.github/​workflows/​m33mu.yml	Add footprint CI and fix dispatch selection and concurrency naming.

_{Review effort: Balanced}

[aidangarske]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #81

Scan targets checked: none
Failed targets: wolftrust-src, wolftrust-bugs
Not reviewed (no scan target covers them): .github/workflows/README.md, .github/workflows/m33mu.yml, docs/Crypto-Profiles.md, docs/Interface-Footprint.md, docs/Testing.md, mk/common.mk, mk/crypto-profile.mk, tests/host/Makefile, tests/host/asn_codec/Makefile, tests/host/crypto_profile/test_generator.py, tests/target/lib/scenario_matrix.py, tools/check_interface_footprint.py, tools/crypto_profile.py, tools/measure_interface_footprint.sh

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

Review tier: Max