From c8672388d822df1c96dd9da70775b7698704649e Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 26 Mar 2026 11:22:07 +0100 Subject: [PATCH] Fix the build when TF-PSA-Crypto only has a little MLDSA When TF-PSA-Crypto has pure ML-DSA, we need to handle it in the test driver for signatures. But we must not try to reference ML-DSA identifiers in TF-PSA-Crypto branches where they don't exist yet, even though the compilation option already exists (which notably includes the TF-PSA-Crypto 1.1.0 release). Signed-off-by: Gilles Peskine --- tests/src/drivers/test_driver_signature.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/tests/src/drivers/test_driver_signature.c b/tests/src/drivers/test_driver_signature.c index 010cdfcf4..6ff2ad9c2 100644 --- a/tests/src/drivers/test_driver_signature.c +++ b/tests/src/drivers/test_driver_signature.c @@ -222,7 +222,11 @@ psa_status_t mbedtls_test_transparent_signature_sign_message( return PSA_SUCCESS; } -#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED) + /* In TF-PSA-Crypto 1.1.0, TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED and + * psa_crypto_mldsa.h already exist, but there is no driver dispatch for + * ML-DSA and PSA_ALG_IS_ML_DSA doesn't exist yet. After that, we need + * to worry about pure ML-DSA. */ +#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED) && defined(PSA_ALG_IS_ML_DSA) /* Pure ML-DSA is not a sign-the-hash algorithm. At the moment, this * function only knows how to deal with sign-the-hash algorithms. * So give up and let the next driver in the chain handle the algorithm. @@ -303,7 +307,11 @@ psa_status_t mbedtls_test_transparent_signature_verify_message( return mbedtls_test_driver_signature_verify_hooks.forced_status; } -#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED) + /* In TF-PSA-Crypto 1.1.0, TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED and + * psa_crypto_mldsa.h already exist, but there is no driver dispatch for + * ML-DSA and PSA_ALG_IS_ML_DSA doesn't exist yet. After that, we need + * to worry about pure ML-DSA. */ +#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED) && defined(PSA_ALG_IS_ML_DSA) /* Pure ML-DSA is not a sign-the-hash algorithm. At the moment, this * function only knows how to deal with sign-the-hash algorithms. * So give up and let the next driver in the chain handle the algorithm.