Add RFC 9783 PSA/EAT Support

[aidangarske]

• PSA Initial Attestation API 2.0
• PSA/EAT is fully off by default; no PSA/EAT API symbols or parser code are emitted.
• All 10 public profile, consume, issue, envelope, legacy, and helper gates are independently selectable and documented.
• Algorithms and operations use existing fine-grained ES256/384/512, HMAC256/384/512, Sign1, Mac0, encode, and decode gates.
• RFC 9783 claims remain atomic because compiling mandatory profile behavior out would be noncompliant.

[Copilot]

🔵 Needs a closer look

It introduces substantial new untrusted-input parsing behavior (PSA/EAT + CBOR decode strictness/tolerance changes) that warrants final human security review.

Pull request overview

Adds optional RFC 9783 PSA Attestation Token (EAT) support to wolfCOSE behind fine-grained compile-time gates, including issuer/verifier APIs, profile enforcement, and CI coverage for both full and deliberately lean builds. This extends the codebase’s COSE/CBOR surface in a security-sensitive area (parsing attacker-controlled CBOR/COSE), and introduces a new feature module plus supporting tests, examples, docs, and workflows.

Changes:

• Introduces opt-in PSA/EAT public API (eat_psa.h) and implementation (wolfcose_eat_psa.c) with derived conformance gating (WOLFCOSE_EAT_PSA_TFM_FULL).
• Extends CBOR decode internals to support a private “allow non-preferred definite-length” mode for PSA/EAT while keeping public decode entry points strict; adds UTF-8 validation for all encountered CBOR text strings.
• Adds extensive PSA/EAT tests/examples and wires them into CI (coverage, sanitizers, static analysis, interop, lean builds), plus documentation updates.

File summaries

File	Description
tools/wolfcose_tool.c	Uses the public CBOR decoder initializer and fails fast on malformed CBOR in info.
tests/test_suite.h	Adds PSA/EAT test entry points to the suite header.
tests/test_main.c	Runs PSA/EAT tests as part of the default test binary output.
tests/test_eat_psa.c	PSA/EAT conformance-style tests and delegated-signing seam coverage.
tests/test_eat_psa_profiles.c	Runtime tests for selective PSA/EAT envelope/profile builds and refusal behavior.
tests/test_eat_psa_profile_main.c	Standalone driver for PSA/EAT feature-profile tests.
tests/test_eat_psa_limits.c	Standalone claim-limit boundary tests for PSA/EAT receiver ceilings.
tests/test_eat_psa_curve_gates.c	Compile-only fixture validating curve/ES* gating outcomes for PSA/EAT.
tests/test_eat_psa_hash_gates.c	Compile-only fixture validating NO_SHA256 implications for PSA/EAT receiver claims.
tests/test_eat_psa_min_key_gates.c	Compile-only fixture validating ECC_MIN_KEY_SZ boundary behavior vs PSA/EAT conformance.
tests/test_eat_psa_derived_gate.c	Compile-only fixture validating derived (non-user-selectable) receiver conformance gate behavior.
tests/test_cbor.c	Updates tests for CBOR context ABI/init semantics; adds strictness + UTF-8 boundary coverage (and float writer checks).
tests/interop/t_cose/README.md	Documents PSA/EAT interop expectations/limitations in the t_cose harness.
tests/interop/t_cose/interop_tcose.c	Adds PSA/EAT Sign1/Mac0 interop cases (COSE-wire validation + claim verification).
tests/config/eat_psa_no_sha256/user_settings.h	Adds wolfSSL config fixture for NO_SHA256 feature-matrix testing.
tests/config/eat_psa_min_key/user_settings.h	Adds wolfSSL config fixture for ECC_MIN_KEY_SZ boundary testing.
tests/config/eat_psa_curves/user_settings.h	Adds wolfSSL config fixture for P-256-only curve gating tests.
tests/config/eat_psa_config/config.h	Adds config.h fixture to validate configure-style PSA/EAT feature selection.
src/wolfcose_internal.h	Adds private decode flags and “_ex” internal decode APIs; extends header-state for text-label tracking under gates.
src/wolfcose_cbor.c	Implements private decode-flag plumbing, UTF-8 validation for CBOR tstr, and stricter encode/decode context separation.
src/wolfcose_eat_psa.c	Implements RFC 9783 PSA/EAT claims parsing/verification and issuance under feature gates.
include/wolfcose/settings.h	Adds PSA/EAT feature matrix gates and derives full #tfm receiver capability; tightens ES*/HMAC256 derivation conditions.
include/wolfcose/wolfcose.h	Documents strict decode vs PSA/EAT tolerance, UTF-8 validation behavior, and text-label extension semantics.
include/wolfcose/eat_psa.h	New public PSA/EAT API header (types, errors, and gated entry points).
scripts/cmdline-test.sh	Adds CLI info negative test for malformed CBOR (with one message inversion to fix).
scripts/test_pkg_config.sh	Expands pkg-config rebuild coverage to include new PSA/EAT source/header and timestamp precision handling.
scripts/check_stack_usage.sh	Includes PSA/EAT stack-usage report in the enforced frame budget check.
examples/psa_eat_verify_lean.c	New lean “verify-only full #tfm” example exercising RFC appendix vectors and non-preferred CBOR tolerance.
examples/psa_eat_demo.c	New onboarding demo showing issuance + nonce verification + component appraisal flow.
examples/lifecycle_demo.c	Uses CBOR encoder initializer and checks its return before encoding.
README.md	Advertises optional PSA attestation support and new make targets/examples/docs links.
docs/Testing.md	Documents PSA/EAT test targets, coverage expectations, and CI behavior.
docs/Release-Notes.md	Notes addition of optional RFC 9783 PSA/EAT support.
docs/PSA-EAT.md	New PSA/EAT guide (gating, profiles, trust boundaries, and integration guidance).
docs/Macros.md	Documents PSA/EAT gates and COSE text-label extension option and interactions.
docs/Home.md	Adds PSA attestation to the feature matrix and wiki links.
docs/Getting-Started.md	Updates strict-decoding guidance to note PSA/EAT’s private tolerance and UTF-8 validation behavior.
docs/API-Reference.md	Adds PSA/EAT API reference section and updates CBOR context description/strictness notes.
docs/_Sidebar.md	Adds PSA-EAT doc to the sidebar.
ChangeLog.md	Adds PSA/EAT feature entry.
.gitignore	Ignores new PSA/EAT test binaries and examples.
.github/workflows/build-test.yml	Runs PSA/EAT conformance tests, examples, and feature-matrix checks in CI.
.github/workflows/coverage.yml	Collects and enforces coverage for wolfcose_eat_psa.c at 100% in the full profile.
.github/workflows/interop.yml	Adds PSA/EAT vector verification and extends interop job labeling.
.github/workflows/lean-build.yml	Adds lean full-#tfm verifier build/run and asserts no signing APIs are linked.
.github/workflows/sanitizer.yml	Runs PSA/EAT tests and forced-failure coverage under ASan.
.github/workflows/static-analysis.yml	Adds cppcheck/scan-build coverage for the full PSA/EAT profile.
.github/workflows/stack-bounds.yml	Builds full PSA/EAT profile with stack-usage instrumentation and enforces per-frame budgets.
.github/workflows/codeql.yml	Builds PSA/EAT tests during CodeQL CI to include the new module in analysis.
.github/workflows/wolfssl-versions.yml	Runs PSA/EAT tests at the wolfSSL compatibility floor.
.github/workflows/misra-2012.yml	Includes PSA/EAT translation unit in MISRA checks and enables PSA/EAT gates for analysis.
.github/workflows/misra-2023.yml	Enables PSA/EAT gates in MISRA 2023 builds/checks.

Review details

• Files reviewed: 53/55 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #75

Scan targets checked: wolfcose-bugs, wolfcose-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.