[Frauschi]

Summary

Adds a build option that links a static wolfSSL into libwolfpkcs11.so, so the module ships as one library with no run-time dependency on libwolfssl. The embedded wolfSSL is hidden, so an application that uses its own wolfSSL, even one built with a different configuration, can still load the module through dlopen() or wc_Pkcs11_Initialize().

• Autotools: --with-static-wolfssl=/path/to/libwolfssl.a
• CMake: -DWOLFPKCS11_STATIC_WOLFSSL=yes against a wolfSSL built with -DBUILD_SHARED_LIBS=OFF -DCMAKE_POSITION_INDEPENDENT_CODE=ON

The default build is unchanged.

How it works

• The library is linked with --exclude-libs,ALL, so none of the wolfSSL symbols are exported. Without it, the module's wolfSSL calls bind to the application's libwolfssl.so despite RTLD_LOCAL, which crashes when the two configurations differ.
• -Bsymbolic binds the module's own C_* calls to itself. -z text and -z defs turn a non-PIC archive or a function missing from the archive into a link error, instead of a module that quietly resolves against the host's wolfSSL.
• The option needs an ELF linker and a static wolfSSL, and builds only the shared library. It rejects wolfTPM, because libwolftpm links its own wolfSSL and the TPM crypto callback would be registered in the wrong copy.
• In this mode the installed CMake package and wolfpkcs11-config no longer refer to wolfSSL.

Fixes found along the way

• CMake exported about 200 internal symbols. The autotools build compiles with hidden visibility and the CMake build did not. CMake now builds with hidden visibility and defines HAVE_VISIBILITY.
• The PKCS#11 v3.0/v3.2 functions were not exported by the autotools build (C_LoginUser, C_Message*, C_EncapsulateKey, ...), because their prototypes lacked WP11_API. Both builds now export the same 92 C_* functions and nothing else.
• CMake debug_test exits 77 in non-debug builds, and CTest counted that as a failure. It is now registered with skip code 77.
• The autotools CMake package pointed at NONE/include when configure ran without --prefix, so find_package(wolfpkcs11) failed. The install paths are now expanded with the default prefix.
• The wolfSSL interop test never called wolfCrypt_Init() and only worked because the module did it on the shared libwolfcrypt. It now initializes wolfCrypt itself, loads the module only through wc_Pkcs11_Initialize(), and takes the module to test from WOLFPKCS11_MODULE. The debug probe also no longer unloads the module before the test loads it, so a debug module logs again.

Tests

• New static-wolfssl.yml workflow with an autotools job and a CMake job. Each builds against a static wolfSSL and checks that the library has no libwolfssl dependency and no text relocations, and that it exports only C_* (including the v3.0 entry points). It then runs the test suite and the wolfSSL interop test against the library, installs it, and builds and runs a small find_package(wolfpkcs11) consumer with no wolfSSL on the search path.
• Eleven tests set allocators with wolfSSL_SetAllocators(). In static mode that call reaches the test's wolfSSL, not the module's, so these tests are built but not run there. The default build still runs them.
• The interop test target refuses an external WOLFPKCS11_MODULE that depends on libwolfssl. The check uses readelf and is skipped for the default in-tree module, so the default interop test still runs without binutils.

[Copilot]

🔵 Needs a closer look

Cryptographic symbol isolation and cross-build packaging require human validation of linker compatibility and interoperability results.

No open issues 🎉

What changed in this PR

Adds optional static wolfSSL embedding so libwolfpkcs11 can operate without a runtime libwolfssl dependency.

Changes:

• Adds Autotools and CMake options with symbol isolation and dependency-free package metadata.
• Corrects public symbol visibility and interoperability test initialization.
• Adds CI coverage for static embedding and installed-package consumers.

File	Description
wolfpkcs11/​pkcs11.h	Exports v3.0 and v3.2 functions.
tests/​wolfssl-interoperability/​pkcs11_interop.c	Initializes wolfCrypt and preserves the module handle.
tests/​wolfssl-interoperability/​Makefile	Supports external modules and checks dependencies.
tests/​include.am	Excludes allocator-sensitive tests in embedded mode.
src/​include.am	Adds isolation flags and archive dependency.
README.md	Documents static embedding requirements and usage.
configure.ac	Adds static embedding configuration and fixes install paths.
CMakeLists.txt	Adds embedding, hidden visibility, and debug-test skipping.
cmake/​wolfpkcs11Targets.cmake.in	Omits the embedded wolfSSL link dependency.
cmake/​wolfpkcs11Config.cmake.in	Skips wolfSSL discovery for embedded builds.
cmake/​consumer/​main.c	Checks installed API access.
cmake/​consumer/​CMakeLists.txt	Builds an installed-package consumer.
.github/​workflows/​static-wolfssl.yml	Tests both build systems, isolation, and packaging.

_{Review effort: Balanced}

[LinuxJedi]

Good call on the pkcs11.h fixes too!