Allow for FIPS builds without ED25519 & MD5

[lealem47]

Goes along with wolfSSL/wolfssl#11144

[Copilot]

Pull request overview

This PR improves wolfCLU’s behavior (and test suite robustness) when building against wolfSSL configurations that omit MD5 and/or ED25519 (e.g., FIPS-focused builds), by returning NOT_COMPILED_IN with clearer messages and having tests skip appropriately instead of failing.

Changes:

• Added a shared Python test helper to detect NOT_COMPILED_IN via wolfCLU’s "Error returned: -174." reporting and updated select tests to skipTest() when algorithms are not present.
• Updated MD5-related setup paths (hash/dgst/bench/HMAC) to return NOT_COMPILED_IN and emit consistent “not compiled in” errors when NO_MD5 is enabled.
• Updated ED25519 verify/sign codepaths to return NOT_COMPILED_IN when ED25519 support is not compiled in.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/wolfclu_test.py	Adds NOT_COMPILED_IN constant and not_compiled_in() helper for skipping optional-algorithm tests.
tests/hash/hash-test.py	Skips MD5 hash test when MD5 isn’t compiled into wolfSSL.
tests/genkey_sign_ver/genkey-sign-ver-test.py	Skips optional key-type generation when wolfSSL reports NOT_COMPILED_IN (e.g., ED25519 omitted).
tests/bench/bench-test.py	Skips MD5 benchmark when MD5 isn’t compiled into wolfSSL.
src/tools/clu_funcs.c	Adds NO_MD5 handling in HMAC hash selection for MD5.
src/sign-verify/clu_verify.c	Returns/logs NOT_COMPILED_IN when ED25519 verify is unavailable; silences unused params in stubs.
src/sign-verify/clu_sign.c	Returns NOT_COMPILED_IN for ED25519 sign when unavailable; silences unused params in stub.
src/sign-verify/clu_dgst_setup.c	Returns/logs NOT_COMPILED_IN for -md5 selection when NO_MD5.
src/hash/clu_hash_setup.c	Returns/logs NOT_COMPILED_IN for md5 shortcut when NO_MD5.
src/benchmark/clu_bench_setup.c	Ensures --md5 is recognized even under NO_MD5 so a targeted NOT_COMPILED_IN error can be returned.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sebastian-carpenter]

MEDIUM-2: dgst MD5 tests not updated, so the NO_MD5 test run still fails [SUGGEST] (test)
File: tests/dgst/dgst-test.py:37-43,86-96,427,468-476
Function: DgstTest.test_verify_md5_rsa / test_sign_verify_all_hash_algs / HmacTest.test_hmac_vectors
Confidence: High

This commit changes exactly two MD5 code paths that tests/dgst/dgst-test.py exercises — clu_dgst_setup.c:622-629 (dgst -md5 now returns NOT_COMPILED_IN) and clu_funcs.c:1394 (wolfCLU_hmacHash MD5 now returns NOT_COMPILED_IN) — but the dgst suite was not given the new not_compiled_in() skip that bench-test.py, hash-test.py and genkey-sign-ver-test.py received. test_verify_md5_rsa and test_sign_verify_all_hash_algs (which appends "md5" whenever not is_fips()) and HmacTest.test_hmac_vectors (VECTORS["md5"]) are guarded only by is_fips(), never by MD5 availability. On a NO_MD5 build all three assert returncode == 0 against a command that now deliberately returns -174, so they fail. The commit's stated goal ("Allow for builds without ... MD5") is therefore not achieved for the dgst suite. test_fail_wrong_digest (dgst-test.py:74-79) would still pass, but for the wrong reason — it would be asserting the MD5-absent error rather than the digest-mismatch behaviour it is named for.

Code:
@unittest.skipIf(is_fips(), "MD5 not allowed in FIPS builds")
def test_verify_md5_rsa(self):
r = run_wolfssl("dgst", "-md5", "-verify", ...)
self.assertEqual(r.returncode, 0, r.stderr)

        algs = ["sha", "sha224", "sha256", "sha384", "sha512"]
        if not is_fips():
            algs.append("md5")

    VECTORS = {
        "md5":    "b4dcc86b987a882a22c04126bf38754b", ...

Recommendation: Apply the same not_compiled_in() skip to test_verify_md5_rsa, the md5 sub-test of test_sign_verify_all_hash_algs, and the md5 entry of HmacTest.test_hmac_vectors (and test_hmac_HEX_vectors if it carries an md5 vector), so a NO_MD5 build actually passes end to end.