headers: resolve wolfSSL's config through settings.h

[yosuke-wolfssl]

Problem

wolfCert read wolfSSL's feature set in two public headers that resolved it
independently — wolfcert/memory.h and wolfcert/check_config.h — both via a
bare <wolfssl/options.h>, which a wolfSSL configured by its own
user_settings.h does not meaningfully have.

wolfcert.h reaches memory.h before types.h while every other public header
goes straight to types.h → check_config.h, so the two readers disagree and
the project compiles or fails per translation unit under identical flags:

Translation unit	one reader fixed
#include <wolfcert/wolfcert.h>	0 errors
#include <wolfcert/est.h>	22 tier-2 error lines

Fix

check_config.h resolves the feature set once:

#if !defined(WOLFSSL_USER_SETTINGS) && !defined(WOLFSSL_USE_OPTIONS_H) && \
    !defined(WOLFSSL_NO_OPTIONS_H) && !defined(WOLFSSL_CUSTOM_CONFIG) && \
    !defined(ARDUINO) && !defined(PLATFORMIO) && \
    !defined(USE_HAL_DRIVER) && !defined(NUCLEUS_PLUS_2_3) && \
    !defined(WOLFSSL_MX2_CONF_INCLUDE)
    #define WOLFSSL_USE_OPTIONS_H
#endif
#include <wolfssl/wolfcrypt/settings.h>

• In check_config.h this sits above tier 1, so types.h always reaches
  wolfSSL's config; WOLFCERT_NO_WOLFSSL_FEATURE_CHECK now skips the tier-2
  #error checks only.
• CMakeLists.txt and configure.ac probe through the same preamble, so
  configure no longer rejects a --enable-usersettings wolfSSL the headers
  accept.
• memory.h reaches that resolution through <wolfcert/types.h> rather than
  repeating the selectors, and wolfcert.h includes types.h before it.
  Previously a selector set inside user_settings.h resolved differently per
  TU, and <wolfcert/memory.h> alone had no ordering check at all.
• A separate check stops a build whose wolfSSL header arrived first, leaving
  options.h unread — silent otherwise, and silent here means a linked ABI
  mismatch. It sits outside the tier-2 gate, and silences tier 2 when it fires,
  since that feature set was never resolved: one error instead of twelve.
• 32 files under src/, tests/, cli/ and examples/ included
  <wolfssl/options.h> after a wolfCert header, re-applying a foreign build's
  macros over the validated config. Deleted, not guarded.

Tests

scripts/ci/check-config-resolution.sh preprocesses one <wolfcert/est.h> and
one <wolfcert/wolfcert.h> TU and compares resolved macros, exit status and
diagnostics. Each case stages an options.h that disagrees with
user_settings.h; an absent or forwarding one lets both agree for the wrong
reason.

Case	WOLFSSL_USER_SETTINGS	Expected
usersettings-wins	on	both build, neither reads options.h
optionsh-decoy	on	both stop on the same tier-2 #errors
optionsh-wins	off	both build, both name options.h
wolfssl-header-first	off	both stop on the ordering error, alone
selector-in-user-settings	off	selector arrives inside the file; both agree

compile-freestanding.sh no longer fabricates an options.h stub, so it
independently catches the same defect for the 5 sources in its compile set.

Verification

• CMake and autoconf clean, 30/30 tests each; header-only build 30/30.
• All nine opt-out selectors confirmed by probe. Both entry headers agree with
  WOLFSSL_NO_OPTIONS_H set inside user_settings.h, and under
  WOLFCERT_CUSTOM_ALLOC with -Werror.
• Negative controls: pre-fix tree, check_config.h-only and memory.h-only
  each fail; reverting memory.h alone reddens the freestanding gate.

Not in this PR

The selector block is still written out three times — check_config.h,
CMakeLists.txt and configure.ac — and the gate compares only the headers, so
header/build-file drift would have configure probing a different feature set
than the headers compile against. One internal header included by both would
close it by construction.

[Copilot]

🟢 Approval recommended

No unresolved review comments were identified, and all supplied assessments indicate approval readiness.

Pull request overview

This PR standardizes wolfSSL configuration resolution through settings.h and improves header-only integration.

Changes:

• Removed redundant direct options.h inclusions.
• Added configuration-resolution and freestanding regression checks.
• Updated documentation, examples, workflows, and lint coverage.

File summaries

File	Summary
wolfcert/memory.h	Resolves wolfSSL settings consistently.
wolfcert/check_config.h	Validates settings through settings.h.
src/scep/scep_server.c	Removes redundant options include.
src/scep/scep_msg.c	Removes redundant options include.
src/scep/scep_client.c	Removes redundant options include.
src/pkcs7_util.c	Removes redundant options include.
src/key_algs.h	Relies on centralized configuration.
src/internal.h	Removes redundant options include.
src/est/est_server.c	Removes redundant options include.
src/ca_issue.c	Removes redundant options include.
scripts/ci/config-probe.c	Adds configuration probing.
scripts/ci/compile-freestanding.sh	Tests native user-settings resolution.
scripts/ci/check-config-resolution.sh	Verifies consistent configuration resolution.
examples/user_settings.h.example	Clarifies shared configuration usage.
docs/EMBEDDED.md	Documents settings resolution.
docs/CI.md	Documents the new CI gate.
.github/workflows/pr.yml	Runs configuration-resolution checks.
.github/workflows/lint.yml	Extends license-header checks.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #31

Scan targets checked: wolfcert-src, wolfcert-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #31

Scan targets checked: wolfcert-src, wolfcert-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #31

Scan targets checked: wolfcert-src, wolfcert-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Frauschi]

Went through the config-resolution change carefully and reproduced each of these against the current head.

The headline one is that the umbrella path still diverges from the est.h path. wolfcert.h includes memory.h before types.h, so memory.h evaluates the eight new selectors before user_settings.h has been read. With WOLFSSL_NO_OPTIONS_H set inside user_settings.h - which examples/user_settings.h.example encourages - <wolfcert/est.h> builds and <wolfcert/wolfcert.h> fails outright. That is the same per-translation-unit split this PR sets out to remove, moved one layer up, and swapping two lines in wolfcert.h closes it.

Second thing worth settling before merge: the include-order invariant has no diagnostic at all under WOLFCERT_NO_WOLFSSL_FEATURE_CHECK, and docs/EMBEDDED.md states the wrong precondition for it. The rest are smaller - a probe that reports a false negative, a dead settings.h include, and a set -e abort that truncates the new gate's own report.

The approach is right and the new gate is a good idea. I would just like it to catch the case above before this goes in.

[yosuke-wolfssl]

Thank you @Frauschi for reviewing.
I reworked on this. Could you review it again ?

[Frauschi]

Second round. All seven comments from the first round are fixed - I re-ran both original reproductions rather than reading the diff, and both are closed: the WOLFCERT_NO_WOLFSSL_FEATURE_CHECK path now errors on both entry headers where it used to link a sizeof mismatch, and the WOLFSSL_NO_OPTIONS_H-inside-user_settings.h case now preprocesses identically from est.h and wolfcert.h. Locally 29/29 with no warnings, and the branch rebases clean onto current main.

Two gaps left, both small, and both about the fix surviving rather than the fix being right:

1. The wolfcert.h ordering fix has no regression test - the gate is green with it reverted (mutation-proved below).
2. memory.h still has no ordering diagnostic, so the silent ABI mismatch is closed on one of the two readers.

Details inline.