From 961d5c8a747e27ecf7ca96ac95b7280dc0aa950b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 16 Jul 2026 10:53:23 +0200 Subject: [PATCH 1/2] CMake: wire WOLFSSL_HAVE_XMSS and add XMSS verify-only/small sub-options CMake accepted -DWOLFSSL_XMSS=1 but never emitted WOLFSSL_HAVE_XMSS, so wc_xmss.c compiled empty and options.h advertised no XMSS support. Add the missing definition block (mirroring LMS) plus WOLFSSL_XMSSVERIFYONLY and WOLFSSL_XMSSSMALL sub-options for parity with autotools --enable-xmss= verify-only,small, and expose all three in the generated options.h. Also enable WOLFSSL_XMSS in the cmake.yml CI build, which tested LMS but not XMSS -- the blind spot that let this regression through. --- .github/workflows/cmake.yml | 1 + CMakeLists.txt | 26 ++++++++++++++++++++++++++ cmake/options.h.in | 4 ++++ configure.ac | 2 +- 4 files changed, 32 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml index 354f8d9e024..15dbeead38f 100644 --- a/.github/workflows/cmake.yml +++ b/.github/workflows/cmake.yml @@ -71,6 +71,7 @@ jobs: -DWOLFSSL_TLSX:BOOL=yes -DWOLFSSL_TPM:BOOL=yes -DWOLFSSL_CLU:BOOL=yes -DWOLFSSL_USER_SETTINGS:BOOL=no \ -DWOLFSSL_USER_SETTINGS_ASM:BOOL=no -DWOLFSSL_WOLFSSH:BOOL=ON -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes \ -DWOLFSSL_MLKEM:BOOL=yes -DWOLFSSL_LMS:BOOL=yes -DWOLFSSL_LMSSHA256192:BOOL=yes \ + -DWOLFSSL_XMSS:BOOL=yes \ -DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \ -DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \ -DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \ diff --git a/CMakeLists.txt b/CMakeLists.txt index 7345e9afb1d..2fe919e998f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1122,6 +1122,32 @@ add_option(WOLFSSL_XMSS "Enable the wolfSSL XMSS implementation (default: disabled)" "no" "yes;no") +add_option(WOLFSSL_XMSSVERIFYONLY + "Enable the XMSS/XMSS^MT verify-only implementation (default: disabled)" + "no" "yes;no") + +add_option(WOLFSSL_XMSSSMALL + "Enable the smaller, slower XMSS/XMSS^MT implementation (default: disabled)" + "no" "yes;no") + +if (WOLFSSL_XMSS) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_XMSS") + + set_wolfssl_definitions("WOLFSSL_HAVE_XMSS" RESULT) + + if (WOLFSSL_XMSSVERIFYONLY) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_XMSS_VERIFY_ONLY") + + set_wolfssl_definitions("WOLFSSL_XMSS_VERIFY_ONLY" RESULT) + endif() + + if (WOLFSSL_XMSSSMALL) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_XMSS_SMALL") + + set_wolfssl_definitions("WOLFSSL_WC_XMSS_SMALL" RESULT) + endif() +endif() + # SLH-DSA add_option(WOLFSSL_SLHDSA "Enable the wolfSSL SLH-DSA implementation (default: disabled)" diff --git a/cmake/options.h.in b/cmake/options.h.in index 36bc8da272e..3ca18e792dc 100644 --- a/cmake/options.h.in +++ b/cmake/options.h.in @@ -413,6 +413,10 @@ extern "C" { #cmakedefine WOLFSSL_HAVE_XMSS #undef WOLFSSL_WC_XMSS #cmakedefine WOLFSSL_WC_XMSS +#undef WOLFSSL_XMSS_VERIFY_ONLY +#cmakedefine WOLFSSL_XMSS_VERIFY_ONLY +#undef WOLFSSL_WC_XMSS_SMALL +#cmakedefine WOLFSSL_WC_XMSS_SMALL #undef HAVE_SECRET_CALLBACK #cmakedefine HAVE_SECRET_CALLBACK #undef WC_RSA_DIRECT diff --git a/configure.ac b/configure.ac index 537a51ff99c..a5fc43fa56a 100644 --- a/configure.ac +++ b/configure.ac @@ -1993,7 +1993,7 @@ do no) ;; verify-only) - AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY -DXMSS_VERIFY_ONLY" + AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY" ;; small) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_XMSS_SMALL" From 74bb14aa9fb7ad1050dda69d4a46160d18c3682d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 16 Jul 2026 11:11:02 +0200 Subject: [PATCH 2/2] CMake: add LMS verify-only, small and shake256 sub-options CMake wired only the LMS sha256-192 and no-sha256-256 variants, while autotools --enable-lms also supports verify-only, small and shake256. Add the three missing sub-options (WOLFSSL_LMSVERIFYONLY, WOLFSSL_LMSSMALL, WOLFSSL_LMSSHAKE256), emitting WOLFSSL_LMS_VERIFY_ONLY, WOLFSSL_WC_LMS_SMALL and WOLFSSL_LMS_SHAKE256, and expose them in the generated options.h so the CMake and autotools LMS configurations match. --- CMakeLists.txt | 30 ++++++++++++++++++++++++++++++ cmake/options.h.in | 6 ++++++ 2 files changed, 36 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 2fe919e998f..cfbb0c66148 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1010,6 +1010,18 @@ add_option(WOLFSSL_LMSNOSHA256256 "Disable the LMS SHA_256_256 standard variant (default: disabled)" "no" "yes;no") +add_option(WOLFSSL_LMSVERIFYONLY + "Enable the LMS/HSS verify-only implementation (default: disabled)" + "no" "yes;no") + +add_option(WOLFSSL_LMSSMALL + "Enable the smaller, slower LMS/HSS implementation (default: disabled)" + "no" "yes;no") + +add_option(WOLFSSL_LMSSHAKE256 + "Enable the LMS SHAKE256 variant (default: disabled)" + "no" "yes;no") + if (WOLFSSL_LMS) list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS") @@ -1026,6 +1038,24 @@ if (WOLFSSL_LMS) set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT) endif() + + if (WOLFSSL_LMSVERIFYONLY) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_VERIFY_ONLY") + + set_wolfssl_definitions("WOLFSSL_LMS_VERIFY_ONLY" RESULT) + endif() + + if (WOLFSSL_LMSSMALL) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_LMS_SMALL") + + set_wolfssl_definitions("WOLFSSL_WC_LMS_SMALL" RESULT) + endif() + + if (WOLFSSL_LMSSHAKE256) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHAKE256") + + set_wolfssl_definitions("WOLFSSL_LMS_SHAKE256" RESULT) + endif() endif() # Experimental features diff --git a/cmake/options.h.in b/cmake/options.h.in index 3ca18e792dc..ae78916f639 100644 --- a/cmake/options.h.in +++ b/cmake/options.h.in @@ -409,6 +409,12 @@ extern "C" { #cmakedefine WOLFSSL_LMS_SHA256_192 #undef WOLFSSL_NO_LMS_SHA256_256 #cmakedefine WOLFSSL_NO_LMS_SHA256_256 +#undef WOLFSSL_LMS_VERIFY_ONLY +#cmakedefine WOLFSSL_LMS_VERIFY_ONLY +#undef WOLFSSL_WC_LMS_SMALL +#cmakedefine WOLFSSL_WC_LMS_SMALL +#undef WOLFSSL_LMS_SHAKE256 +#cmakedefine WOLFSSL_LMS_SHAKE256 #undef WOLFSSL_HAVE_XMSS #cmakedefine WOLFSSL_HAVE_XMSS #undef WOLFSSL_WC_XMSS