Config flag to only build for signature verification

[flynd]

For an application that only needs to verify signatures, not create them (for example a boot stage implementing secure boot), it would be convenient to have a config option removes everything that isn't needed for verification.

Although making everything static (with MLD_CONFIG_EXTERNAL_API_QUALIFIER and MLD_CONFIG_INTERNAL_API_QUALIFIER) allows the compiler to drop C functions and tables that aren't used (but requires -Wno-unused-function to remove warnings), this is only a partial solution as it won't exclude unused functions from the native assembly backends such as poly_decompose_XX_asm and rej_uniform_etaX_asm.

[mkannwischer]

Thanks @flynd! Yes, I support such a configuration option.

Probably the easiest is in the form of

• MLD_CONFIG_NO_KEYPAIR_API
• MLD_CONFIG_NO_SIGN_API
• MLD_CONFIG_NO_VERIFY_API

Aligned with the pre-existing MLD_CONFIG_NO_RANDOMIZED_API.

That said, I don't think I will find the time to implement this this month.
If you need it urgently, maybe you could open a PR @flynd? That would be appreciated!

[flynd]

Thanks @flynd! Yes, I support such a configuration option.

Probably the easiest is in the form of

• MLD_CONFIG_NO_KEYPAIR_API
• MLD_CONFIG_NO_SIGN_API
• MLD_CONFIG_NO_VERIFY_API

Aligned with the pre-existing MLD_CONFIG_NO_RANDOMIZED_API.

That said, I don't think I will find the time to implement this this month. If you need it urgently, maybe you could open a PR @flynd? That would be appreciated!

This is not urgent for me as it is manageable with only a few local changes right now, with most of the work being done by the compiler to just discard everything it doesn't need when everything is static. When #936 has been fixed, I'll consider whether to try and do this myself.

[flynd]

Fixed with #1000 .