Simplified auxiliary algorithms for cert chain verification, TPM, etc

[bigbrett]

This PR adds the ability to enable "auxiliary algorithms" for a given wolfBoot configuration (auxiliary algos are those that must be compiled into the image but are NOT used for primary image signature/integrity verification).

Two notable consumers of this feature are wolfHSM cert chain verification and wolfTPM integration, both of which have been tweaked to leverage the new feature in this PR.

Other wolfBoot features that do this can opt-in via the new macros or build system variables as needed.

Meant as a simpler stopgap alternative to #766 with a much smaller blast radius.

[Copilot]

Pull request overview

This PR introduces a build-time mechanism to compile auxiliary crypto algorithms (algorithms needed by optional features like cert-chain verification, wolfHSM, and wolfTPM, but not used for primary image signature verification). It wires this through the Make-based configuration, updates wolfCrypt user_settings.h to treat primary/secondary/aux algorithms as a union, and adds docs + CI coverage.

Changes:

• Add AUX_PK_ALGOS / AUX_HASH_ALGOS make options to compile additional wolfCrypt objects/macros beyond SIGN/HASH.
• Allow dummy cert-chain generation to choose CA key algorithm + cert signature hash independently from the leaf key algorithm; bridge CA algos into auxiliary lists automatically for the auto-generated chain path.
• Update include/user_settings.h gating so auxiliary algorithms also enable the correct wolfCrypt feature macros, plus add CI matrix builds for aux algos and a mixed-algorithm chain scenario.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tools/scripts/sim-gen-dummy-chain.sh	Extends dummy chain generator to support independent CA/leaf algos and CA hash selection.
tools/config.mk	Adds new config variables (aux algos + cert chain CA settings) to the supported config var list.
options.mk	Implements AUX algorithm parsing/validation and links extra wolfCrypt objects; integrates cert-chain CA algo/hash bridging.
Makefile	Updates dummy-chain generation invocation to pass separate CA/leaf algorithm + CA hash parameters.
include/user_settings.h	Unifies primary/secondary/aux algorithm inclusion and adjusts wolfCrypt feature gating accordingly.
docs/wolfHSM.md	Documents mixed-algorithm chain support and how to use auxiliary algorithm lists.
docs/TPM.md	Documents TPM’s ECC/RSA requirement and AUX fallback behavior.
docs/compile.md	Adds “Auxiliary crypto algorithms” section documenting AUX_* usage and constraints.
config/examples/sim-wolfHSM-server-certchain-rsa2048-ca.config	New example config for mixed-algorithm cert chain verification.
.github/workflows/test-wolfhsm-simulator.yml	Adds a mixed-algorithm cert-chain verification job to the wolfHSM simulator workflow.
.github/workflows/test-configs.yml	Adds new config job and AUX algo compile-only matrix coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #822

Scan targets checked:wolfboot-bugs, wolfboot-src

No new issues found in the changed files. ✅

[bigbrett]

@danielinux I know I let this idea linger, apologies, but now I'm having to revisit this feature now due to some customer pressure.

After a bit more meditation, I think initially taking a simpler approach than #766 is warranted, at least as a first step.

This PR is still an impt step towards decoupling the wolfBoot algo selection from the wolfBoot meta-features themselves, but doesn't go quite as far as #766 by completely overhauling/splitting out user_settings into the addative fragments. However nothing about this PR would prohibit us eventually doing something a la #766, but I'm not quite happy with that one yet and am under pressure to support cert chain verification with algos different than that of the image signature. I think we should get something like this in first and can add user settings fragmentation later.