Commit Graph

34496 Commits

Author SHA1 Message Date
Ronald Cron 5cd633798c Merge pull request #10769 from mpg/security-link-dev
Update broken link in SECURITY.md
2026-06-05 15:44:33 +00:00
Manuel Pégourié-Gonnard af15f6e244 Update broken link
I believe the existing link was to the TF wiki which has been retired
for some time now.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2026-06-03 10:33:29 +02:00
Janos Follath 545d1b77a2 Merge pull request #10741 from valeriosetti/fix-mbedtls_config
mbedtls_config.c missing mbedtls_platform_requirements.h
2026-05-26 09:24:54 +00:00
minosgalanakis 701132e5b3 Merge pull request #10663 from yiwu0b11/remove_unused_ffdh_code
Remove FFDH-specific code from compat.sh
2026-05-13 16:49:20 +00:00
Ronald Cron 00be9c9b67 Merge pull request #10700 from gilles-peskine-arm/python-project-knowledge-directory-mbedtls-dev
Create Python project knowledge directory
2026-05-12 13:38:23 +00:00
Manuel Pégourié-Gonnard 902b012537 Merge pull request #10749 from bjwtaylor/broken-build
Update framework pointer to bring in fix for python imports
2026-05-07 19:13:19 +00:00
Ben Taylor 954e236500 Update tf-psa-crypto pointer to bring in fix for python imports
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
2026-05-07 14:17:54 +01:00
Ben Taylor 02fb4c75cb Update framework pointer to bring in fix for python imports
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
2026-05-07 08:14:43 +01:00
Valerio Setti cd8b3878c5 changelog: add note about fix of issue 10740
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-04-29 17:05:51 +02:00
Valerio Setti b155a58ab5 include mbedtls_platform_requirements.h in mbedtls_config.c
This is required because if the user defined configuration file (not the
default one provided by mbedtls) includes files from the standard
C library then __STDC_WANT_LIB_EXT1__ won't be defined there which
cause weird build failures.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-04-29 16:57:55 +02:00
minosgalanakis d12fbb991c Merge pull request #10695 from valord577/patch-1
Fix build warning/error using llvm-mingw
2026-04-29 14:52:00 +00:00
Gilles Peskine a314ada082 Merge pull request #10631 from yiwu0b11/destdir_install_env_support
Support DESTDIR for install and add build-system test
2026-04-29 14:37:29 +00:00
Valerio Setti ae8579f2a2 Merge pull request #10650 from valeriosetti/fix-tls13-guard
check_config: add missing check for TLS 1.3 key exchanges
2026-04-24 14:32:36 +00:00
Valerio Setti 51b62060de Merge pull request #10639 from valeriosetti/ecdhe-rsa-fix-check
library: check_config: remove RSA encryption requirement from ECDHE-RSA
2026-04-24 07:30:47 +00:00
Gilles Peskine 52ca15362b Update comment
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-22 17:38:48 +02:00
Valerio Setti c3d52b905b check_config: fix error message for missing TLS 1.2 key exchanges
Align the error message to the one used for the same check in TLS 1.3.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-04-22 15:00:55 +02:00
Valerio Setti 5ea77200d9 check_config: add check for TLS 1.3 key exchanges
When MBEDTLS_SSL_PROTO_TLS1_3 is enabled ensure that at least one of the
related key exchanges is also enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-04-22 15:00:54 +02:00
valord577 68319cbc80 update ChangeLog
Signed-off-by: valord577 <valord577@gmail.com>
2026-04-22 11:05:04 +08:00
valord577 e022733f9f Merge branch 'Mbed-TLS:development' into patch-1 2026-04-22 10:41:51 +08:00
Ronald Cron 391af7c976 Merge pull request #10701 from minosgalanakis/docs/4.1.0_changelog_fixes
ChangeLog: Fixed a reference to TF-PSA-Crypto
2026-04-20 09:38:38 +00:00
Ronald Cron 518ed0337d Merge pull request #10672 from Maokaman1/fix/tls12-rsa-pss-sigalgs
ssl: accept TLS 1.2 rsa_pss_rsae signature algorithms
2026-04-20 08:03:39 +00:00
Viktor Sokolovskiy f90e81c7f8 Pacify uncrustify
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
2026-04-18 01:51:17 +03:00
Maokaman1 78336bb5bd Merge branch 'Mbed-TLS:development' into fix/tls12-rsa-pss-sigalgs 2026-04-17 19:13:43 +03:00
Minos Galanakis 935eb1a53b ChangeLog: Fixed a reference to TF-PSA-Crypto
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2026-04-17 16:59:05 +01:00
Viktor Sokolovskiy 3d61c38ea0 ssl: add TLS 1.2 RSA-PSS debug trace
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
2026-04-17 17:36:31 +03:00
Gilles Peskine cf0bbfd024 Prefer to load tf_psa_crypto_test_case_info from project_knowledge
Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three
ways, depending on the age of the tf-psa-crypto submodule:

* Modern: import `tf_psa_crypto_test_case_info` as an ordinary module,
  expected to be found in `tf-psa-crypto/scripts/project_knowledge`.
* First location, quickly superseded: load
  `tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`,
  in a hackish way because we don't want to put that directory on the
  load path.
* Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded
  list.

Once all the TF-PSA-Crypto branches we care about (e.g. pull requests
in progress) are updated with
`tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`,
we can drop the backward compatibilty hacks and simply
`import tf_psa_crypto_test_case_info` unconditionally and use
`tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-16 19:17:02 +02:00
Gilles Peskine d934b7b751 Add tf-psa-crypto/scripts/project_knowledge to Python load path
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-16 19:16:30 +02:00
valord577 37b81f13c7 add ChangeLog
Signed-off-by: valord577 <valord577@gmail.com>
2026-04-16 15:17:32 +08:00
valord577 a3d3ede9d6 Fix build warning/error using llvm-mingw
error logs refs: https://github.com/valord577/nativepkgs/actions/runs/24490614774/job/71574726128

Signed-off-by: valord577 <valord577@gmail.com>
2026-04-16 14:31:55 +08:00
Viktor Sokolovskiy 2168fe9cda ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
2026-04-16 04:36:48 +03:00
Yi Wu 970df30a8f test: improve symlink checks
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-15 12:13:09 +01:00
Gilles Peskine 8426c9bc51 Merge pull request #10684 from gilles-peskine-arm/maintainer-scripts-create-directory-dev
development: Create a directory for maintainer-only Python scripts
2026-04-15 08:19:36 +00:00
Gilles Peskine 8bf89416cf Merge pull request #10647 from gilles-peskine-arm/github-pr-template-add-4.1-mbedtls
Add 1.1 line to the PR template
2026-04-15 08:17:24 +00:00
Yi Wu 0c02d74a48 test: versioned symlink order fix
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-14 11:06:16 +01:00
Yi Wu f38b17e7a0 test: reorder if-else structure
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-14 10:12:44 +01:00
Yi Wu 331ad77fe2 test: add debug output and fix for win config
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 15:13:52 +01:00
Yi Wu 6fb557c31a ChangeLog fix
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 15:00:44 +01:00
Gilles Peskine 6b31bc6885 Unify TF-PSA-Crypto and mbedtls templates
Following the team discussion, don't suggest "prerequisite" or "consuming"
in the template. Suggest linking all the pull requests in a group
everywhere.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-13 14:57:07 +02:00
Yi Wu e9e0409b11 tests: fix DESTDIR install checks and add macOS compatibility
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 12:48:01 +01:00
Yi Wu 15be9e9048 ChangeLog fixes
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 12:12:24 +01:00
Gilles Peskine 2a7d1ece77 Merge pull request #10676 from gilles-peskine-arm/analyze_outcomes-read_crypto
Let TF-PSA-Crypto define test cases that Mbed TLS does not need to cover
2026-04-13 09:24:21 +00:00
Gilles Peskine cc134b0b94 Update crypto submodule with analyze_outcomes.py
Update framework to match.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-10 14:49:14 +02:00
Yi Wu f14f28ce75 ChangeLog padding space fix
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-10 10:27:09 +01:00
Gilles Peskine 9248af96b1 Create a directory for maintainer-only Python scripts
This directory is currently excluded from `check-python-files.sh`, because
we run it on the CI in an old Python version that doesn't support some of
our new maintainer scripts.

There are no such scripts in mbedtls for now (only in TF-PSA-Crypto), but be
ready if we want to add some.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-09 19:39:42 +02:00
Gilles Peskine 806e1d365b Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 17:22:10 +02:00
Gilles Peskine d25f03919a INTERNAL_TEST_CASES moved to a separate data-only module
This way, when Mbed TLS's `analyze_outcomes.py` loads the python module from
TF-PSA-Crypto (because it needs to know the value of `INTERNAL_TEST_CASES`),
there's no risk that the subproject and the superproject will have different
requirements on auxiliary modules such as `mbedtls_framework.outcome_analysis`.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 15:47:49 +02:00
Gilles Peskine 16a90a556e Add copyright line
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 15:31:52 +02:00
Viktor Sokolovskiy f75c033ead ssl: add TLS 1.2 RSA-PSS regression coverage
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
2026-04-07 20:20:09 +03:00
Gilles Peskine 667a3f6442 Move test currently covered by crypto from uncovered list to ignored list
If we can't read `INTERNAL_TEST_CASES` from
`tf-psa-crypto/tests/scripts/analyze_outcomes.py` because the script doesn't
exist, hard-code the legacy value of that information.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:47:24 +02:00
Gilles Peskine 1978e1bd6b Ignore test cases that TF-PSA-Crypto tells us to ignore
If the `tf-psa-crypto` submodule has `tests/scripts/analyze_outcomes.py`,
require it to define a global variable `INTERNAL_TEST_CASES`. Those test
cases will be ignored in Mbed TLS's coverage analysis.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:47:13 +02:00