Add a zephyr module port

[yosuke-wolfssl]

Problem

wolfCert has no Zephyr integration, so it can only be built and tested on a
POSIX host — nothing proves it works on an RTOS target, and there is no way to
consume it as a Zephyr module.

Getting an on-target run working also surfaced one library bug:
wolfcert_http_request() called XMALLOC(0) for a Content-Length: 0 body,
and picolibc returns NULL for a zero-size request — so an EST 401 challenge
surfaced as WOLFCERT_ERR_MEMORY instead of WOLFCERT_ERR_AUTH.

Fix

src/http.c asks for one byte on a zero-length body and skips the copy,
matching the read-until-close branch. This is the only change to library
sources.

zephyr/ is the module: Kconfig, and a CMakeLists.txt that renders
wolfcert/options.h from the CONFIG_WOLFCERT_* symbols, reusing the existing
options.h.in. Client-only — the in-tree test server drives sockets directly
and stays host-side. The transport is src/net_posix.c unchanged, under
CONFIG_POSIX_API.

Tests

The four EST client cases move into tests/integration/est_client_cases.h so
host and target share one copy.

Suite	What runs
wolfcert_unit_*	the 7 existing tests/unit programs
wolfcert_est	3 ztest cases against a host wolfcert-server
wolfcert.build.*	transport off, RSA-only, SCEP-only-RSA, POSIX store
samples/	the sample, run not just compiled

.github/workflows/zephyr.yml runs both on qemu_x86 over a cached west
workspace. twister exits 0 when every configuration is filtered out, so
scripts/ci/twister-assert-ran.py fails a step whose suites did not run.

Verification

• Host: 30/30 ctest, clean build.
• qemu_x86: 13 configurations, 0 failed, 0 errored; EST gate 3/3.
• Reverting the http.c fix makes test_session_basic_auth fail on target
  with rc=-3 (out of memory).

Not in this PR

FRDM-MCXN947 support, an NVS store backend, ML-DSA, and a SCEP target test —
all phase 2. A TLS-free build for SCEP-only targets is tracked separately.

[Copilot]

🟡 Changes recommended

Unresolved critical public-header compatibility and moderate test cleanup issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a Zephyr module port for wolfCert with Kconfig/CMake integration, QEMU coverage, an EST sample, CI, and portability fixes.

Changes:

• Adds Zephyr module configuration, tests, documentation, certificates, and CI.
• Shares EST client cases between host and Zephyr tests.
• Fixes zero-length HTTP response handling and Zephyr socket macro collisions.
• Outstanding findings: one critical public-header issue, three moderate cleanup issues, and one documentation nit.

File summaries

File	Summary
zephyr/wolfssl_user_settings.h	Zephyr wolfSSL feature configuration.
zephyr/tests/wolfcert_unit_store/testcase.yaml	Registers store unit tests.
zephyr/tests/wolfcert_unit_store/prj.conf	Configures store unit tests.
zephyr/tests/wolfcert_unit_store/CMakeLists.txt	Builds store unit tests.
zephyr/tests/wolfcert_unit_smoke/testcase.yaml	Registers smoke tests.
zephyr/tests/wolfcert_unit_smoke/prj.conf	Configures smoke tests.
zephyr/tests/wolfcert_unit_smoke/CMakeLists.txt	Builds smoke tests.
zephyr/tests/wolfcert_unit_scep_msg/testcase.yaml	Registers SCEP message tests.
zephyr/tests/wolfcert_unit_scep_msg/prj.conf	Configures SCEP message tests.
zephyr/tests/wolfcert_unit_scep_msg/CMakeLists.txt	Builds SCEP message tests.
zephyr/tests/wolfcert_unit_parse_negative/testcase.yaml	Registers negative parsing tests.
zephyr/tests/wolfcert_unit_parse_negative/prj.conf	Configures negative parsing tests.
zephyr/tests/wolfcert_unit_parse_negative/CMakeLists.txt	Builds negative parsing tests.
zephyr/tests/wolfcert_unit_keygen/testcase.yaml	Registers key-generation tests.
zephyr/tests/wolfcert_unit_keygen/prj.conf	Configures key-generation tests.
zephyr/tests/wolfcert_unit_keygen/CMakeLists.txt	Builds key-generation tests.
zephyr/tests/wolfcert_unit_csr/testcase.yaml	Registers CSR tests.
zephyr/tests/wolfcert_unit_csr/prj.conf	Configures CSR tests.
zephyr/tests/wolfcert_unit_csr/CMakeLists.txt	Builds CSR tests.
zephyr/tests/wolfcert_unit_csr_attrs/testcase.yaml	Registers CSR attribute tests.
zephyr/tests/wolfcert_unit_csr_attrs/prj.conf	Configures CSR attribute tests.
zephyr/tests/wolfcert_unit_csr_attrs/CMakeLists.txt	Builds CSR attribute tests.
zephyr/tests/wolfcert_est/testcase.yaml	Registers the EST test.
zephyr/tests/wolfcert_est/src/main.c	Runs EST cases against the host.
zephyr/tests/wolfcert_est/prj.conf	Configures EST networking.
zephyr/tests/wolfcert_est/CMakeLists.txt	Builds the EST test.
zephyr/tests/common/wolfcert.conf	Shared Zephyr test configuration.
zephyr/tests/common/unit_test.cmake	Shared unit-test build logic.
zephyr/tests/common/test_shim.c	Wraps existing unit tests for Zephyr.
zephyr/samples/wolfcert_est_client/src/main.c	Implements the EST client sample.
zephyr/samples/wolfcert_est_client/sample.yaml	Registers the EST sample.
zephyr/samples/wolfcert_est_client/README.md	Documents the EST sample.
zephyr/samples/wolfcert_est_client/prj.conf	Configures the EST sample.
zephyr/samples/wolfcert_est_client/CMakeLists.txt	Builds the EST sample.
zephyr/README.md	Documents Zephyr usage; a nit remains to document the CONFIG_WOLFSSL=y prerequisite.
zephyr/module.yml	Declares the Zephyr module.
zephyr/Kconfig	Defines module configuration symbols.
zephyr/include.am	Distributes Zephyr files.
zephyr/CMakeLists.txt	Integrates the module build and generated options.
tests/unit/test_http.c	Tests zero-length HTTP responses.
tests/integration/test_est_roundtrip.c	Uses shared EST cases.
tests/integration/est_client_cases.h	Shared EST cases; three moderate cleanup findings remain on failed assertion paths.
src/internal.h	Handles Zephyr socket macros; a critical issue remains because the guard is too late for public-header declarations.
src/http.c	Handles zero-length response bodies safely.
scripts/ci/zephyr-add-wolfssl.py	Adds wolfSSL to west manifests.
Makefile.am	Includes Zephyr distribution files.
examples/certs/README.md	Documents certificate generation.
examples/certs/mldsa/server-cert.pem	Updates the server certificate.
examples/certs/gen-certs.sh	Adds the QEMU gateway SAN.
examples/certs/ecc/server-cert.pem	Updates the server certificate.
docs/EMBEDDED.md	Documents embedded sizing and clock requirements.
.github/workflows/zephyr.yml	Runs Zephyr QEMU CI.

Review details

Suppressed comments (4)

tests/integration/est_client_cases.h:59

• This helper now runs as a Zephyr ztest, but REQUIRE returns immediately after dk (and later csr, issued, DER, and certificate-manager objects) are allocated. wolfcert_cleanup() only tears down wolfSSL globally and cannot reclaim these per-test objects, so a failed assertion leaks into subsequent cases and can make the target suite fail for the wrong reason. Route failure paths through cleanup instead of returning directly.

    REQUIRE(wolfcert_key_generate(&kcfg, &dk) == WOLFCERT_OK);

tests/integration/est_client_cases.h:118

• On any failed assertion after dk is generated, this helper returns without freeing the key, CSR, issued buffer, DER, or decoded certificate. Because the same code is executed by multiple Zephyr ztests and the suite teardown does not own these objects, failures can accumulate leaked heap allocations. Use a cleanup path for each failure rather than the direct-return REQUIRE macro here.

    REQUIRE(wolfcert_key_generate(&kcfg, &dk) == WOLFCERT_OK);

tests/integration/est_client_cases.h:174

• This session helper has the same failure-path leak in a more resource-intensive test: a failed REQUIRE can leave the key, CSR, open EST session, buffers, and DER object live, and can also leave bs open after the bad-password half. wolfcert_cleanup() does not close these handles, so later ztests may inherit exhausted sockets or heap. Replace the direct-return assertions with cleanup-aware failure paths.

    REQUIRE(wolfcert_key_generate(&kcfg, &dk) == WOLFCERT_OK);

zephyr/README.md:45

• WOLFCERT has depends on WOLFSSL in zephyr/Kconfig:15, so setting only CONFIG_WOLFCERT=y leaves the module disabled unless the application already enables wolfSSL. Please document the required CONFIG_WOLFSSL=y prerequisite (as the shared test config does) or change the Kconfig dependency.

`CONFIG_WOLFCERT=y` enables the library; `menuconfig` lists the rest under

• Files reviewed: 52/52 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #29

Scan targets checked: wolfcert-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[yosuke-wolfssl]

This requires PR #31