wolfHSM: expose max verify roots in options.mk

[bigbrett]

Exposes an important wolfHSM config variable to be settable by users via .config

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #847

No scan targets match the changed files in this PR. Review skipped.

[Copilot]

Pull request overview

Expose WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS as a user-configurable build option (via .config) and propagate it into wolfHSM client/server builds so the trusted-root maximum used during certificate-chain verification can be kept consistent across builds.

Changes:

• Add WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS ?= 8 default to options.mk.
• Pass -DWOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS=... into CFLAGS for WOLFHSM_CLIENT and WOLFHSM_SERVER builds.
• Clarify in the WOLFHSM_NVM_ROOT_CA_LIST comment that the max-roots setting is user-configurable and must match the HSM server firmware build.

Suppressed comments (1)

options.mk:1501

• WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS is now configurable, but it is only propagated into the build via CFLAGS in the WOLFHSM_CLIENT/WOLFHSM_SERVER blocks. The TrustZone wolfHSM server mode (WOLFCRYPT_TZ_WOLFHSM) also builds wolfHSM server code and should define the same value; otherwise overriding this in .config can silently create a client/server wire-format mismatch.

# Maximum trusted-root count for wolfHSM cert-chain verification. Part of the
# client<->server wire format, so every wolfHSM build in the system (wolfBoot
# client or server, and any separately built HSM server firmware) must use
# the same value.
WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS ?= 8

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.