Resolve the wolfSSL FIPS Ready bundle at CI run time

[aidangarske]

Description

• FIPS Ready CI was pinned to wolfssl-5.8.2, hardcoded in fips-ready.yml and perf-regression.yml.
  --enable-fips=ready is not a fixed FIPS version: it moved from v7 to v8 as of bundle 5.9.2.
• CI kept testing FIPS v7 while the actual FIPS Ready download had moved to v8 with no coverage.
• wolfProvider did not build against FIPS v8: SHA-512/224 and SHA-512/256 were registered in the
  provider dispatch table but their definitions stayed gated on HAVE_FIPS, so v8 modules hit an
  undefined-reference link error.
• New scripts/fetch-fips-ready.sh resolves, downloads, and verifies FIPS Ready bundles at CI run
  time instead of a hardcoded version, with bounded retry and checksum verification.
  _discover-versions.yml gains fips_ready_latest/_pr_array/_all_array outputs; PR runs test the
  back-compat anchors plus newest, nightly sweeps every hosted bundle.
• Fixed the v8 SHA-512/224/256 registration bug by routing both sides through the same
  WP_HAVE_SHA512_224/256 capability macros; added RSA dupctx tests exercising the affected
  wp_hash_copy() branches.
• Discovery failures fail loudly (new fips_ready_resolved gate) instead of silently testing a
  one-version floor and reporting green.

[Copilot]

Pull request overview

This PR updates wolfProvider’s FIPS Ready CI to resolve/download the hosted bundle set at workflow runtime (instead of pinning a single hardcoded version), and fixes provider + test coverage gaps needed to build against newer FIPS Ready bundles (notably the v8 transition where SHA-512/224 and SHA-512/256 become available).

Changes:

• Add scripts/fetch-fips-ready.sh plus network-free tests, and wire it into _discover-versions.yml, fips-ready.yml, perf-regression.yml, and a new nightly-fips-ready.yml sweep.
• Fix SHA-512/224 and SHA-512/256 capability gating so provider registration and internal dispatch (wp_hash_copy) stay consistent for FIPS Ready v8.
• Add digest + RSA dupctx unit tests to exercise the affected hash-copy branches.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/unit.h	Adds prototypes for new digest/RSA dupctx tests (and related conditional declarations).
test/unit.c	Registers new digest tests and RSA dupctx tests into the unit test case table under capability macros.
test/test_rsa.c	Adds RSA dupctx tests that copy an in-progress digest-sign context to exercise wp_hash_copy() for SHA512-224/256.
test/test_digest.c	Adds SHA512-224 and SHA512-256 digest creation tests under capability macros.
src/wp_wolfprov.c	Registers SHA512-224/256 digests based on unified WP capability macros.
src/wp_internal.c	Routes SHA512-224/256 wp_hash_copy() cases through the same WP capability macros to avoid v8 link/dispatch mismatches.
src/wp_digests.c	Builds SHA512-224/256 digest implementations behind WP capability macros (aligned with settings).
scripts/utils-wolfssl.sh	Adds v7.*/linuxv7.* mapping for --enable-fips= configure argument resolution.
scripts/test-fetch-fips-ready.sh	Adds deterministic, network-free tests for bundle resolution/probing and safe fetch/replace behavior.
scripts/include.am	Includes the new fetch script in distribution script lists.
scripts/fetch-fips-ready.sh	New resolver/downloader: runtime discovery, bounded retries, checksum/integrity verification, and safe replacement.
scripts/build-wolfprovider.sh	Updates help text to document ready tracking behavior and the new fetch helper.
include/wolfprovider/settings.h	Defines WP_HAVE_SHA512_224/256 based on wolfSSL/FIPS/selftest capability macros (supports v8 exports).
docs/FIPS_INTEGRATION_GUIDE.md	Documents how ready maps to FIPS generations across bundle versions and how to use the new fetch script.
.github/workflows/README.md	Updates workflow documentation to describe dynamic FIPS Ready matrices and nightly sweep behavior.
.github/workflows/pr-osp-select.yml	Adds a selectable fips-ready nightly workflow entry.
.github/workflows/perf-regression.yml	Switches perf FIPS bundle to discovered latest, adds a hard gate to fail if discovery degraded to floor-only.
.github/workflows/nightly-osp.yml	Adds fips-ready to the out-of-wave nightly OSP suite.
.github/workflows/nightly-fips-ready.yml	New nightly workflow to sweep all hosted FIPS Ready bundles (plus tests for the fetch script).
.github/workflows/fips-ready.yml	Uses runtime-discovered PR bundle set and adds a “require resolved” gate; runs fetch script tests.
.github/workflows/_discover-versions.yml	Adds outputs for FIPS Ready latest/PR/all arrays plus a resolved/degraded flag; checks out repo to run the resolver script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #463

Scan targets checked: wolfprovider-bugs, wolfprovider-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🔵 [Low] WP_HAVE_SHA512_224/256 no longer exclude pre-v7 FIPS modules · FIPS compliance issues

The macros drop the old !defined(HAVE_FIPS) guard and rely solely on WOLFSSL_NOSHA512_224/256, which wolfSSL sets from configure (FIPS v2/v5/v6 blocks) and not from headers. A FIPS build driven by user_settings.h with a pre-v7 module enables these algorithms although sha512.h declares the direct API only for FIPS >= 5.3 and hash.c supports WC_HASH_TYPE_SHA512_224/256 in wc_HashInit_ex only for FIPS >= 7.0.0.

Fix: Mirror wolfSSL's own availability gate by adding (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0,0)) to both capability macros.