Add fips-hash-offline.sh

[holtrop-wolfssl]

Description

This script calculates the FIPS integrity hash for an already-linked binary offline at build time.

Tested with fips/optest-140-3/static-building/optest-run-static-test.sh

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Adds a new build-time utility script to compute and patch the wolfCrypt FIPS in-core integrity hash directly into an already-linked binary (intended for static/offline build flows), and documents how it differs from the existing source-patching workflow.

Changes:

• Added fips-hash-offline.sh to compute the in-core integrity HMAC over ELF ranges and patch verifyCore[] in-place in the binary.
• Updated fips-hash.sh header comments to clarify its runtime/scrape-and-patch-source behavior and reference the offline variant.
• Listed the new script in SCRIPTS-LIST.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
SCRIPTS-LIST	Adds an entry for the new offline FIPS hash patching script.
fips-hash.sh	Adds documentation explaining purpose and when to use the offline script instead.
fips-hash-offline.sh	New script implementing offline hash computation and in-place patching of verifyCore[] in a linked ELF binary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +660 B (+1.0%, 64,155 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +1,072 B (+0.9%, 122,481 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .rodata.wolfSSL_ERR_reason_error_string.str1.1 +54 B, .text +1,152 B (+0.6%, 200,320 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +768 B (+1.2%, 66,827 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +832 B (+0.5%, 174,568 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +1,088 B (+0.6%, 180,888 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +704 B (+1.2%, 61,741 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +392 B, .text +2,624 B (+0.4%, 771,148 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .text +1,152 B (+0.6%, 212,588 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +116 B, .text +1,344 B (+0.5%, 279,396 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +112 B, .text +1,408 B (+0.5%, 324,992 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +704 B (+1.2%, 61,741 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +1,024 B (+0.8%, 123,213 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .rodata.wolfSSL_ERR_reason_error_string.str1.1 +54 B, .text +1,280 B (+0.6%, 236,082 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .rodata.wolfSSL_ERR_reason_error_string.str1.1 +54 B, .text +1,152 B (+0.6%, 200,320 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +116 B, .text +1,344 B (+0.5%, 279,972 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +4 B, .rodata.str1.1 +58 B, .rodata.wolfSSL_ERR_reason_error_string.str1.1 +54 B, .text +1,280 B (+0.6%, 236,146 B / 262,144 B, total: 90% used)

linuxkm-pie

• Data: __patchable_function_entries +1,264 B (+5.2%, 25,552 B)

linuxkm-standard

• Data: __patchable_function_entries +2,200 B (+4.8%, 48,216 B)

stm32-sim-stm32h753

• FLASH: .text +1,776 B (+1.0%, 183,460 B / 2,097,152 B, total: 9% used)

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 5 total — 5 posted, 0 skipped
5 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] Hash pipeline can silently emit a wrong-but-correct-length hash (no pipefail, dd errors hidden) — fips-hash-offline.sh:141-163
• [Medium] Offline hash is never validated against the module's own self-test — fips-hash-offline.sh:41-46,161-170
• [Medium] New 170-line FIPS helper script has no automated test — fips-hash-offline.sh:1-170
• [Low] Relies on GNU dd byte-granular flags; command -v check does not detect them — fips-hash-offline.sh:58-62,88-90,158
• [Low] readelf re-invoked many times over the same binary — fips-hash-offline.sh:67-84,93-100,125-157

Review generated by Skoll

[douzzer]

This is great! Worked for me on src/.libs/libwolfssl.so.45.0.0 once I fixed sym_val() and sym_size().