Move WOLFSSL_X509_TINY test to the unit test suite and run

[aidangarske]

Description

• Move the x509 tiny test to api.c for testing in make check.
• Adds CI entry for x509 tiny

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

stm32-sim-stm32h753

• FLASH: .text +64 B (+0.0%, 183,892 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 2 total — 2 posted, 0 skipped

Posted findings

• [Low] critUnknown assertion gated on WOLFSSL_NO_ASN_STRICT, but the code does not relax it — tests/api.c:3866-3872
• [Info] Double blank line after the moved test function — tests/api.c:3887-3889

Review generated by Skoll via Claude/Codex

[Frauschi]

🔵 [Low] critUnknown assertion gated on WOLFSSL_NO_ASN_STRICT, but the code does not relax it
💡 SUGGEST test

The new critical-unknown-extension assertion is wrapped in #ifndef WOLFSSL_NO_ASN_STRICT, implying the rejection only happens in strict builds. But the source is explicit that this is not relaxed by WOLFSSL_NO_ASN_STRICT: wolfcrypt/src/asn.c:22053-22057 comments "RFC 5280 4.2 makes this a MUST that WOLFSSL_NO_ASN_STRICT does not relax", and the default case at asn.c:22058-22061 sets ASN_CRIT_EXT_E unconditionally on a critical unknown extension. I confirmed the code returns ASN_CRIT_EXT_E regardless of the strict flag, and that it propagates out of wc_ParseCert even under NO_VERIFY (asn.c:24766-24767). So the guard needlessly drops this assertion in WOLFSSL_NO_ASN_STRICT builds and slightly contradicts the source comment. Note this is not exercised by the x509-tiny CI job (which does not define WOLFSSL_NO_ASN_STRICT), so it is a coverage/clarity issue, not a CI failure.

Suggestion:

Suggested change

	#ifndef WOLFSSL_NO_ASN_STRICT
	/* Unknown critical extension is rejected regardless of WOLFSSL_NO_ASN_STRICT
	* (RFC 5280 4.2 MUST, see asn.c DecodeExtensionType default case). */
	wc_InitDecodedCert(&cert, tinyCert_critUnknown,
	(word32)sizeof(tinyCert_critUnknown), NULL);
	ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
	WC_NO_ERR_TRACE(ASN_CRIT_EXT_E));
	wc_FreeDecodedCert(&cert);

[Frauschi]

⚪ [Info] Double blank line after the moved test function
🔧 NIT style

The moved block ends with #endif followed by two blank lines before test_wolfSSL_CTX_load_verify_locations_ex. Single blank-line separation is the norm elsewhere in this file. Purely cosmetic.

Suggestion:

Suggested change

	#endif /* WOLFSSL_X509_TINY && HAVE_ECC && !NO_ECC256 && !NO_ECC_SECP */
	#endif /* WOLFSSL_X509_TINY && HAVE_ECC && !NO_ECC256 && !NO_ECC_SECP */
	static int test_wolfSSL_CTX_load_verify_locations_ex(void)