support for large and file-backed custom TLVs

[bigbrett]

• Removes the arbitrary small size restriction on custom TLV size
• Adds a mechanism for the sign tool to build custom TLVs with a data payload from a file
• Adds test coverage for new functionality

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #828

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Copilot]

Pull request overview

This pull request extends the tools/keytools/sign utility to support large custom TLVs (up to the 16-bit TLV wire-format limit) and introduces a file-backed mechanism for providing large TLV payloads, along with unit/CI coverage and documentation updates.

Changes:

• Update sign.c to remove the previous small-size cap for --custom-tlv-buffer / --custom-tlv-string, add --custom-tlv-file, and ensure header sizing is precomputed consistently for both full and delta signing.
• Add a new Python unit test that validates >255-byte custom TLVs, header growth behavior, boundary conditions, and delta inverse-patch consistency.
• Update docs and CI to cover and exercise the new functionality.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tools/unit-tests/unit-sign-custom-tlv-large.py	New regression/unit test covering large and file-backed custom TLVs, header growth, and delta inverse-patch invariants
tools/unit-tests/Makefile	Adds the new unit test to the unit-test runner target
tools/keytools/sign.c	Implements large custom TLV handling, adds --custom-tlv-file, and adjusts header sizing logic for full/delta signing paths
docs/Signing.md	Documents new max TLV sizes, the new --custom-tlv-file option, and header auto-growth behavior
.github/workflows/test-custom-tlv-simulator.yml	Adds a simulator workflow job that signs and validates retrieval of larger custom TLVs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #828

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

tools/keytools/sign.c:3256

• When the hex string is empty, len becomes 0 and malloc(0) may legally return NULL; the current NULL check would then treat an empty TLV as an allocation failure on some platforms. Allocate at least 1 byte (while keeping len=0), or explicitly reject empty values, to avoid platform-dependent behavior.

            len = (uint16_t)(slen / 2);
            CMD.custom_tlv[p].tag = tag;
            CMD.custom_tlv[p].len = len;
            CMD.custom_tlv[p].buffer = malloc(len);
            if (CMD.custom_tlv[p].buffer == NULL) {
                fprintf(stderr, "Error malloc for custom tlv buffer %d\n", len);

tools/keytools/sign.c:3299

• An empty --custom-tlv-string value results in len=0 and malloc(0), which may return NULL per the C standard; the current check would then fail with a misleading malloc error on some platforms. Allocate at least 1 byte (keeping len=0) or explicitly reject empty strings.

            len = (uint16_t)slen;
            CMD.custom_tlv[p].tag = tag;
            CMD.custom_tlv[p].len = len;
            CMD.custom_tlv[p].buffer = malloc(len);
            if (CMD.custom_tlv[p].buffer == NULL) {
                fprintf(stderr, "Error malloc for custom tlv buffer %d\n", len);
                exit(16);

[KotMorderca]

Hello!
Nice work on this - file-backed custom TLVs are a solid addition, I'm happy to see this.

One idea on top of it: the flow DER → extract raw public key → hex string → custom TLV feels like it will be a pretty common use case, so it might be worth wrapping the whole thing into a single sign tool command instead of making people do the extraction manually every time.

Something like:

--custom-tlv-pubkey-der <tag> <file.der>

that parses the DER, pulls out the subjectPublicKey BIT STRING, and feeds it straight into the TLV - instead of requiring a separate openssl step to strip the ASN.1 wrapper before pointing at --custom-tlv-file or --custom-tlv-buffer.

What do you think about this?
Happy to help test it if you think it's worth adding.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #828

Scan targets checked: wolfboot-bugs, wolfboot-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.