[holtrop-wolfssl]

Description

Fix to build, link, and pass unit and doc tests in both FIPS v5.2.1 (current linuxv5 fips-check) and commercial bundle for 5.2.3.

Testing

Built and ran full test suite in both fips-check.sh linuxv5 keep and commercial release bundle 5.2.3 (wolfssl 5.9.4) environments.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

FIPS v5 configurations defining only HAVE_FIPS_VERSION are misdetected, leaving RNG::reseed() enabled despite its hidden C symbol and PSS verification disabled.

2 open issues

• Fall back to HAVE_FIPS_VERSION when detecting FIPS v5 · New
• Preserve FIPS_V5_2_3 metadata and document FIPS_V5 · New

What changed in this PR

This PR improves the Rust wolfCrypt wrapper’s compatibility with FIPS v5.2.1 and v5.2.3, adjusting API availability and documentation examples.

Changes:

• Broaden FIPS version detection and related RNG/RSA API gates.
• Use detected availability for RSA RNG binding and remove the fallback declaration.
• Update doctests with FIPS permissions, compatible feature gates, and a longer PBKDF2 password.

File	Description
wrapper/​rust/​wolfssl-wolfcrypt/​build.rs	Generalize FIPS v5 detection and metadata.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​sys.rs	Remove the fallback RSA RNG declaration.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​rsa.rs	Adjust PSS and RNG gates; update doctests.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​random.rs	Disable reseeding across FIPS v5 builds.
wrapper/​rust/​wolfssl-wolfcrypt/​tests/​test_random.rs	Align reseed test availability with the API.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​prf.rs	Enable FIPS private-key access in doctests.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​pbkdf2_password_hash.rs	Use a longer password in the example.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​kdf.rs	Add FIPS permission setup to the SSH KDF example.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​hkdf.rs	Add FIPS permission setup to HKDF examples.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​ecc.rs	Add FIPS permission setup to ECC examples.
wrapper/​rust/​wolfssl-wolfcrypt/​src/​dh.rs	Add FIPS permission setup to DH examples.

_{Review effort: Balanced}