Enforce NONMODIFIABLE and TRUSTED NVM policy on keystore key commit by yosuke-wolfssl · Pull Request #492 · wolfSSL/wolfHSM

yosuke-wolfssl · 2026-07-26T23:30:55Z

Problem

wh_Server_KeystoreCommitKey writes the cached key to NVM through the
unchecked wh_Nvm_AddObjectWithReclaim, so nothing consulted the stored
object's flags. A client could overwrite an existing NONMODIFIABLE or
TRUSTED NVM object — including a trusted KEK — by caching a key under its id
and committing. Closes f-4225.

Fix (`src/wh_server_keystore.c`)

Added a WH_KS_OP_COMMIT branch to _KeystoreCheckPolicy that reads the
stored object's metadata and denies the overwrite:

Stored flags, not cached flags — an unchecked cache path
(unwrap-and-cache, SHE) cannot launder the policy by populating a slot whose
flags do not reflect the stored object.
NONMODIFIABLE | TRUSTED — the same pair as wh_Nvm_AddObjectChecked,
the correct model for an add-shaped operation. NONDESTROYABLE gates
destroy, not overwrite.
Independent of cache residency — the verdict comes from nvmMeta whether
or not the cache slot survived, so a denied commit always reports
WH_ERROR_ACCESS instead of the WH_ERROR_NOTFOUND raised by a missing slot.
Unreadable flags fail closed — a backend that cannot report metadata
cannot be policed, so the commit is denied rather than blind.

Client-visible behavior change: re-committing a cached key whose stored
object is NONMODIFIABLE now returns WH_ERROR_ACCESS where a byte-identical
rewrite previously returned WH_ERROR_OK. This makes commit consistent with
every other immutable-write path — _NvmCheckPolicy (WH_NVM_OP_ADD) already
refuses a no-op rewrite, and commit was the only exception. The contract is now
documented on wh_Server_KeystoreCommitKeyChecked
(wolfhsm/wh_server_keystore.h): a client retrying after a lost response must
treat WH_ERROR_ACCESS as "already committed". Revoke is unaffected; it keeps
its own "already revoked and committed" short-circuit.

Tests

Added to test-refactor/client-server/wh_test_crypto_keystore.c, driven only
by wh_Client_*:

_whTest_NonModifiableCommit — first commit succeeds, repeat commit returns
WH_ERROR_ACCESS, the denial still holds once the slot is evicted, and the
stored bytes and label survive the denial. Gated behind
WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS, since a committed
NONMODIFIABLE object cannot be erased.
_whTest_ModifiableRecommit — ungated; a key without the flag still commits
repeatedly.

Making that gate runnable. test-refactor could not build with the macro
defined at all: wh_test_crypto_keypolicy.c calls WH_CLIENT_DEVID(client)
inside a helper that takes no client context (pre-existing on main, so both
gated suites were dead code). Threading the context into
whTest_RevocationTryAESEncrypt fixes it, and a new trailing step in
.github/workflows/build-and-test-refactor.yml builds and runs with the macro
defined. That revives this PR's deny-path test and the keypolicy AES-CBC
revocation test, dormant since 606866e.

Verification

Config	Gate off	Gate on
default	45 passed, 26 skipped, 0 failed of 71	45 / 26 / 0
`DMA=1 ASAN=1`	49 passed, 22 skipped, 0 failed of 71	49 / 22 / 0

Identical counts either way; clean under -std=c90 -Werror -Wall -Wextra,
ASan clean. Legacy test/ suite exits 0.
Negative control: with only the WH_KS_OP_COMMIT branch reverted, the gated
run fails — Non-modifiable key was re-committed unexpectedly: 0.

Copilot

Pull request overview

This pull request closes a defense-in-depth gap in the server keystore “gate” by ensuring WH_KEY_COMMIT cannot overwrite existing NVM objects that are marked NONMODIFIABLE or TRUSTED. The policy enforcement is implemented centrally in the keystore policy checker (rather than in the lower-level commit function), and is validated via a new server-side test suite.

Changes:

Add a WH_KS_OP_COMMIT policy branch that consults the stored NVM object’s flags and denies overwrite when NONMODIFIABLE or TRUSTED.
Register and add a new server test (whTest_KeystoreCommitPolicy) covering overwrite-denial, first-commit allowance, normal commit round-trip, and the “uncached commit returns NOTFOUND” guard.
Extend the server test registry to include the new test.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
`src/wh_server_keystore.c`	Enforces `NONMODIFIABLE`/`TRUSTED` overwrite denial for commit by checking stored NVM metadata when a cache slot is being committed.
`test-refactor/server/wh_test_keystore_policy.c`	Adds targeted server-side tests validating commit policy behavior and ensuring stored bytes/flags remain unchanged on denied overwrite.
`test-refactor/wh_test_list.c`	Registers the new keystore commit policy test in the server test group.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #492

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅

Frauschi

🐺 Skoll Code Review

Overall recommendation: CONDITIONAL
Findings: 6 total — 3 posted, 3 skipped

Posted findings

[Low] Repeat/idempotent commit of a NONMODIFIABLE key now fails with WH_ERROR_ACCESS (undeclared client-visible behavior change) — src/wh_server_keystore.c:247-263
[Info] The TRUSTED half of the new check is only reachable via unchecked cache paths; comment does not say so — src/wh_server_keystore.c:248-257
[Info] Commit-overwrite does not consider NONDESTROYABLE, unlike the evict gate — src/wh_server_keystore.c:247-263

Skipped findings

[Low] New access-control branch has no test coverage at any level, and the stated rationale for omitting tests does not hold
[Info] Re-committing an already-committed NONMODIFIABLE key now returns WH_ERROR_ACCESS, breaking idempotent commit retries
[Info] Commit path now hard-depends on the optional NVM GetMetadata callback

Review generated by Skoll via Claude/Codex

yosuke-wolfssl · 2026-07-30T01:12:40Z

Hello @Frauschi ,
I fixed this based on your feedbacks.
Could you review it again ?

Frauschi

🐺 Skoll Code Review

Overall recommendation: CONDITIONAL
Findings: 6 total — 2 posted, 4 skipped

Posted findings

[Low] New test leaves an undeletable NONMODIFIABLE NVM object, bypassing the repo's WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS convention — test-refactor/client-server/wh_test_crypto_keystore.c:909-911
[Low] Commit denial returns WH_ERROR_NOTFOUND instead of WH_ERROR_ACCESS when the cache slot is gone — src/wh_server_keystore.c:247-263

Skipped findings

[Medium] New keystore test permanently leaks an unerasable NVM object into the shared test fixture
[Low] wh_Client_KeyCommit is no longer idempotent for NONMODIFIABLE keys, making commit retries a hard failure
[Info] Fail-closed unreadable-metadata branch in the new commit policy has no test coverage and returns a non-ACCESS error code
[Info] Revoke path still writes cached bytes to NVM unchecked, contradicting the new comment on the shared switch case

Review generated by Skoll via Claude/Codex

Frauschi

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 10 total — 3 posted, 7 skipped

Posted findings

[Medium] Fix guards only one of the two client-reachable commit paths; LMS/XMSS DMA keygen still commits unchecked — src/wh_server_crypto.c:7816
[Medium] Commit is no longer idempotent for NONMODIFIABLE keys, and the contract is undocumented — src/wh_server_keystore.c:247
[Medium] New NONMODIFIABLE commit regression test never compiles or runs in any buildable configuration — test-refactor/client-server/wh_test_crypto_keystore.c:842

Skipped findings

[Medium] New commit-denial test is compiled out in every supported configuration
[Low] Discarded evict return lets the uncached-denial test pass for the wrong reason
[Low] Fail-closed comment does not cover the server->nvm == NULL path
[Low] COMMIT branch duplicates the NVM metadata lookup already performed above the switch
[Low] Discarded evict return leaves Test 4's uncached-commit premise unverified
[Info] Identical 32-byte key literal duplicated across the two new tests
[Info] _KeystoreCheckPolicy now carries two divergent notions of "the key's flags"

Review generated by Skoll via Claude/Codex

Frauschi

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 10 total — 5 posted, 5 skipped

Posted findings

[Medium] New CI step's CFLAGS_EXTRA override silently disables -Werror -Wall -Wextra for the only job that compiles the gated tests — .github/workflows/build-and-test-refactor.yml:133-136
[Medium] No test covers the TRUSTED half of the new commit mask - the actual KEK-overwrite scenario — src/wh_server_keystore.c:261-265
[Medium] Deny-path test could live in test-refactor/server/ and avoid the persistence gate and the new CI job entirely — test-refactor/client-server/wh_test_crypto_keystore.c:842-931
[Medium] Client-facing header not updated with the new non-idempotent commit contract — wolfhsm/wh_server_keystore.h:162-179
[Low] New WH_ERROR_NOTFOUND doc on wh_Server_KeystoreCommitKeyChecked is inaccurate, and the retry contract it documents is incomplete — wolfhsm/wh_server_keystore.h:171-178

Skipped findings

[Low] Gated CI job permanently consumes NVM object slots out of a budget of 30
[Low] WH_KS_OP_REVOKE keeps the unconditional allow the COMMIT branch was added to close, under a new comment asserting it is safe
[Info] Comment says "deny" but the code propagates the backend error code
[Info] Header doc overstates that the verdict never comes from cache flags
[Info] New gated test permanently consumes an NVM slot mid-run, and the TRUSTED half of the new check is untested

Review generated by Skoll via Claude/Codex

yosuke-wolfssl · 2026-08-04T01:01:04Z

Hello @Frauschi ,
Thank you for reviewing again. I fixed the issues you mentioned.
Please check my comments above.

Frauschi

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 5 total — 3 posted, 2 skipped

Posted findings

[Medium] Revoke still launders cached flags into NVM, contradicting the new "Revocation only tightens policy" comment — src/wh_server_keystore.c:269-271
[Low] Suite header comment and README not updated for the two new tests — test-refactor/client-server/wh_test_crypto_keystore.c:19-30
[Info] New CI step covers only the ASAN configuration — .github/workflows/build-and-test-refactor.yml:159-162

Skipped findings

[Medium] NONMODIFIABLE deny path only runs in the new opt-in CI job
[Low] Commit of a cached key now requires a working GetMetadata callback

Review generated by Skoll via Claude/Codex

Frauschi

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 6 total — 3 posted, 3 skipped

Posted findings

[High] Revoke still overwrites a stored TRUSTED/NONMODIFIABLE object, contradicting the new comment and leaving f-4225 half-open — src/wh_server_keystore.c:269-273 (comment), 1435-1440 (write)
[Medium] Uncached-commit assertion can silently degrade into a duplicate of the cached case — test-refactor/client-server/wh_test_crypto_keystore.c:924-932
[Medium] Fail-closed branch on unreadable NVM metadata is untested — src/wh_server_keystore.c:252-261

Skipped findings

[Low] README says gated suites "report SKIPPED", but the new sub-tests vanish silently
[Low] New header contract ("caller must hold the NVM lock") is not followed by the new test added in the same PR
[Low] 32-byte key literal and label setup duplicated verbatim between the two new client tests

Review generated by Skoll via Claude/Codex

Frauschi

LGTM, over to @bigbrett

bigbrett

Need to get rid of some LLM slop in the documentation/doxygen. Otherwise seems reasonable. Over to @rizlik to review, since his platform port relies on the NONMODIFIABLE attribute.

bigbrett · 2026-08-06T14:42:08Z

+ * Runs keystore policy checks before committing. The verdict comes from the
+ * stored NVM object's flags, not the cache slot, so an unchecked cache path
+ * cannot launder them.
+ *
+ * Caller must hold the NVM lock (the WH_KEY_COMMIT handler does): the verdict
+ * reads flags that the commit then overwrites. The lock is not recursive.
+ *
+ * @param[in] server  Server context
+ * @param[in] keyId   Key ID to commit
+ * @return WH_ERROR_OK on success
+ * @return WH_ERROR_ACCESS if an NVM object already exists under keyId and
+ *         carries WH_NVM_FLAGS_NONMODIFIABLE or WH_NVM_FLAGS_TRUSTED, so
+ *         commit is not idempotent for such keys
+ * @return WH_ERROR_NOTFOUND if the key is not resident in the cache, including
+ *         after an already-committed slot was reclaimed
+ * @return the NVM layer's error, typically WH_ERROR_ABORTED, when the stored
+ *         flags cannot be read: an unenforceable policy fails closed
+ *
+ * A retry after a lost response can therefore see either code on a commit that
+ * already succeeded; confirm with an export or metadata read.


This has too much development context LLM slop. Please remove and keep as tight usage documentation.

Suggested change

* Runs keystore policy checks before committing. The verdict comes from the

* stored NVM object's flags, not the cache slot, so an unchecked cache path

* cannot launder them.

*

* Caller must hold the NVM lock (the WH_KEY_COMMIT handler does): the verdict

* reads flags that the commit then overwrites. The lock is not recursive.

*

* @param[in] server Server context

* @param[in] keyId Key ID to commit

* @return WH_ERROR_OK on success

* @return WH_ERROR_ACCESS if an NVM object already exists under keyId and

* carries WH_NVM_FLAGS_NONMODIFIABLE or WH_NVM_FLAGS_TRUSTED, so

* commit is not idempotent for such keys

* @return WH_ERROR_NOTFOUND if the key is not resident in the cache, including

* after an already-committed slot was reclaimed

* @return the NVM layer's error, typically WH_ERROR_ABORTED, when the stored

* flags cannot be read: an unenforceable policy fails closed

*

* A retry after a lost response can therefore see either code on a commit that

* already succeeded; confirm with an export or metadata read.

* Runs keystore policy checks before committing. Caller must hold the NVM lock.

*

* @param[in] server Server context

* @param[in] keyId Key ID to commit

* @return WH_ERROR_OK on success

* @return WH_ERROR_ACCESS if an NVM object already exists under keyId and

* carries WH_NVM_FLAGS_NONMODIFIABLE or WH_NVM_FLAGS_TRUSTED

* @return WH_ERROR_NOTFOUND if the key is not resident in the cache

* @return the NVM layer's error, typically WH_ERROR_ABORTED, if the stored

* flags cannot be read

bigbrett · 2026-08-06T14:42:34Z

@@ -229,6 +248,20 @@ int wh_Server_KeystoreEraseKeyChecked(whServerContext* server, whNvmId keyId);
 * @brief Revoke a key (clears usage and marks non-modifiable)
 *
 * Placeholder implementation for key revocation.


Remove this line, as it is no longer a placeholder

bigbrett · 2026-08-06T14:43:37Z

+ * Revoking rewrites the stored object from the cache slot, so the stored
+ * flags gate it whatever the cached copy says. WH_NVM_FLAGS_NONMODIFIABLE
+ * still permits it, so an already-revoked key can be revoked again.
+ *
+ * Caller must hold the NVM lock (the WH_KEY_REVOKE handler does): the verdict
+ * reads flags that the revoke then overwrites. The lock is not recursive.


Suggested change

* Revoking rewrites the stored object from the cache slot, so the stored

* flags gate it whatever the cached copy says. WH_NVM_FLAGS_NONMODIFIABLE

* still permits it, so an already-revoked key can be revoked again.

*

* Caller must hold the NVM lock (the WH_KEY_REVOKE handler does): the verdict

* reads flags that the revoke then overwrites. The lock is not recursive.

*

* Caller must hold the NVM lock

bigbrett · 2026-08-06T14:44:42Z

+ * @return int 0 on success, else a negative error code. WH_ERROR_ACCESS if a
+ * non-modifiable or server-trusted object already exists under keyId, so commit
+ * is not idempotent for those; WH_ERROR_NOTFOUND if the key left the cache;
+ * WH_ERROR_ABORTED if the stored flags are unreadable. A retry after a lost
+ * response can see either of the first two on a commit that succeeded.


Suggested change

* @return int 0 on success, else a negative error code. WH_ERROR_ACCESS if a

* non-modifiable or server-trusted object already exists under keyId, so commit

* is not idempotent for those; WH_ERROR_NOTFOUND if the key left the cache;

* WH_ERROR_ABORTED if the stored flags are unreadable. A retry after a lost

* response can see either of the first two on a commit that succeeded.

* @return int 0 on success, else a negative error code. WH_ERROR_ACCESS if a

* non-modifiable or server-trusted object already exists under keyId.

* WH_ERROR_ABORTED if the stored flags are unreadable.

bigbrett · 2026-08-06T14:45:21Z

+ * available, or a negative error code on failure. The server-side error codes
+ * are the ones documented on wh_Client_KeyCommit().


Suggested change

* available, or a negative error code on failure. The server-side error codes

* are the ones documented on wh_Client_KeyCommit().

* available, or a negative error code on failure.

bigbrett · 2026-08-06T14:46:11Z


 Results are printed via `WOLFHSM_CFG_PRINTF` from the wolfHSM build. `test-suite.log` contains the detailed output.

+Some sub-tests are opt-in because they leave NVM objects that cannot be erased, so they occupy slots for the rest of the run. Build with `make PERSISTENT_NVM_ARTIFACTS=1` to define `WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS` and include them. Without it they are compiled out of their parent suite, which still runs and passes; unlike a whole entry point that is compiled out, no SKIPPED line is printed for them.


Suggested change

Some sub-tests are opt-in because they leave NVM objects that cannot be erased, so they occupy slots for the rest of the run. Build with `make PERSISTENT_NVM_ARTIFACTS=1` to define `WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS` and include them. Without it they are compiled out of their parent suite, which still runs and passes; unlike a whole entry point that is compiled out, no SKIPPED line is printed for them.

Some sub-tests are opt-in because they leave NVM objects that cannot be erased, so they occupy slots for the rest of the run. Build with `make PERSISTENT_NVM_ARTIFACTS=1` to define `WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS` and include them.

yosuke-wolfssl self-assigned this Jul 26, 2026

Copilot AI review requested due to automatic review settings July 26, 2026 23:30

Copilot started reviewing on behalf of yosuke-wolfssl July 26, 2026 23:31 View session

Copilot AI reviewed Jul 26, 2026

View reviewed changes

yosuke-wolfssl requested a review from wolfSSL-Fenrir-bot July 26, 2026 23:36

wolfSSL-Fenrir-bot reviewed Jul 26, 2026

View reviewed changes

yosuke-wolfssl assigned wolfSSL-Bot and unassigned yosuke-wolfssl Jul 27, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from 6041613 to 0a5c6c1 Compare July 28, 2026 02:48

Frauschi reviewed Jul 29, 2026

View reviewed changes

Comment thread src/wh_server_keystore.c

Comment thread src/wh_server_keystore.c Outdated

Comment thread src/wh_server_keystore.c

Frauschi assigned yosuke-wolfssl and unassigned wolfSSL-Bot Jul 29, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from 0a5c6c1 to 69ca15e Compare July 30, 2026 00:13

yosuke-wolfssl assigned Frauschi and unassigned yosuke-wolfssl Jul 30, 2026

Frauschi reviewed Jul 30, 2026

View reviewed changes

Comment thread test-refactor/client-server/wh_test_crypto_keystore.c Outdated

Comment thread src/wh_server_keystore.c

Frauschi assigned yosuke-wolfssl Jul 30, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from 69ca15e to 69effbc Compare July 31, 2026 00:10

yosuke-wolfssl removed their assignment Jul 31, 2026

Frauschi reviewed Jul 31, 2026

View reviewed changes

Comment thread src/wh_server_keystore.c

Comment thread test-refactor/client-server/wh_test_crypto_keystore.c

Frauschi assigned yosuke-wolfssl and unassigned Frauschi Jul 31, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from 69effbc to f4dc122 Compare August 2, 2026 23:50

yosuke-wolfssl assigned Frauschi and unassigned yosuke-wolfssl Aug 3, 2026

Frauschi reviewed Aug 3, 2026

View reviewed changes

Comment thread .github/workflows/build-and-test-refactor.yml Outdated

Comment thread src/wh_server_keystore.c Outdated

Comment thread test-refactor/client-server/wh_test_crypto_keystore.c

Comment thread wolfhsm/wh_server_keystore.h

Comment thread wolfhsm/wh_server_keystore.h

Frauschi assigned yosuke-wolfssl Aug 3, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from f4dc122 to f1ed323 Compare August 4, 2026 00:24

yosuke-wolfssl removed their assignment Aug 4, 2026

Frauschi reviewed Aug 4, 2026

View reviewed changes

Comment thread src/wh_server_keystore.c Outdated

Comment thread test-refactor/client-server/wh_test_crypto_keystore.c

Comment thread .github/workflows/build-and-test-refactor.yml Outdated

Frauschi assigned yosuke-wolfssl Aug 4, 2026

yosuke-wolfssl force-pushed the fix/f_4225 branch from f1ed323 to 9738bdf Compare August 5, 2026 01:30

yosuke-wolfssl removed their assignment Aug 5, 2026

Frauschi requested changes Aug 5, 2026

View reviewed changes

Comment thread src/wh_server_keystore.c Outdated

Comment thread test-refactor/client-server/wh_test_crypto_keystore.c Outdated

Comment thread src/wh_server_keystore.c

Frauschi assigned yosuke-wolfssl Aug 5, 2026

Enforce NONMODIFIABLE and TRUSTED NVM policy on keystore key commit

d111d86

yosuke-wolfssl force-pushed the fix/f_4225 branch from 9738bdf to d111d86 Compare August 6, 2026 02:39

yosuke-wolfssl removed their assignment Aug 6, 2026

Frauschi approved these changes Aug 6, 2026

View reviewed changes

Frauschi assigned bigbrett and unassigned Frauschi Aug 6, 2026

Frauschi requested a review from bigbrett August 6, 2026 07:24

bigbrett requested changes Aug 6, 2026

View reviewed changes

bigbrett assigned rizlik and unassigned bigbrett Aug 6, 2026

bigbrett requested a review from rizlik August 6, 2026 14:49

		* available, or a negative error code on failure. The server-side error codes
		* are the ones documented on wh_Client_KeyCommit().


		Results are printed via `WOLFHSM_CFG_PRINTF` from the wolfHSM build. `test-suite.log` contains the detailed output.

		Some sub-tests are opt-in because they leave NVM objects that cannot be erased, so they occupy slots for the rest of the run. Build with `make PERSISTENT_NVM_ARTIFACTS=1` to define `WOLFHSM_CFG_TEST_ALLOW_PERSISTENT_NVM_ARTIFACTS` and include them. Without it they are compiled out of their parent suite, which still runs and passes; unlike a whole entry point that is compiled out, no SKIPPED line is printed for them.

Uh oh!

Conversation

yosuke-wolfssl commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix (src/wh_server_keystore.c)

Tests

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #492

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yosuke-wolfssl commented Jul 30, 2026

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yosuke-wolfssl commented Aug 4, 2026

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

Uh oh!

bigbrett left a comment

Choose a reason for hiding this comment

Uh oh!

bigbrett Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

bigbrett Aug 6, 2026

yosuke-wolfssl commented Jul 26, 2026 •

edited

Loading

Fix (`src/wh_server_keystore.c`)