CMake: wire WOLFSSL_HAVE_XMSS and add XMSS verify-only/small sub-options

CMake accepted -DWOLFSSL_XMSS=1 but never emitted WOLFSSL_HAVE_XMSS, so
wc_xmss.c compiled empty and options.h advertised no XMSS support. Add the
missing definition block (mirroring LMS) plus WOLFSSL_XMSSVERIFYONLY and
WOLFSSL_XMSSSMALL sub-options for parity with autotools --enable-xmss=
verify-only,small, and expose all three in the generated options.h.

Also enable WOLFSSL_XMSS in the cmake.yml CI build, which tested LMS but
not XMSS -- the blind spot that let this regression through.

Author: Frauschi

.github/workflows/cmake.yml

@@ -71,6 +71,7 @@ jobs:
             -DWOLFSSL_TLSX:BOOL=yes -DWOLFSSL_TPM:BOOL=yes -DWOLFSSL_CLU:BOOL=yes -DWOLFSSL_USER_SETTINGS:BOOL=no \
             -DWOLFSSL_USER_SETTINGS_ASM:BOOL=no -DWOLFSSL_WOLFSSH:BOOL=ON -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes \
             -DWOLFSSL_MLKEM:BOOL=yes -DWOLFSSL_LMS:BOOL=yes -DWOLFSSL_LMSSHA256192:BOOL=yes \
+            -DWOLFSSL_XMSS:BOOL=yes \
             -DWOLFSSL_X963KDF:BOOL=yes -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PKCS11:BOOL=yes \
             -DWOLFSSL_ECCSI:BOOL=yes -DWOLFSSL_SAKKE:BOOL=yes -DWOLFSSL_SIPHASH:BOOL=yes \
             -DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \

CMakeLists.txt

@@ -1122,6 +1122,32 @@ add_option(WOLFSSL_XMSS
     "Enable the wolfSSL XMSS implementation (default: disabled)"
     "no" "yes;no")
 
+add_option(WOLFSSL_XMSSVERIFYONLY
+    "Enable the XMSS/XMSS^MT verify-only implementation (default: disabled)"
+    "no" "yes;no")
+
+add_option(WOLFSSL_XMSSSMALL
+    "Enable the smaller, slower XMSS/XMSS^MT implementation (default: disabled)"
+    "no" "yes;no")
+
+if (WOLFSSL_XMSS)
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_XMSS")
+
+    set_wolfssl_definitions("WOLFSSL_HAVE_XMSS" RESULT)
+
+    if (WOLFSSL_XMSSVERIFYONLY)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_XMSS_VERIFY_ONLY")
+
+        set_wolfssl_definitions("WOLFSSL_XMSS_VERIFY_ONLY" RESULT)
+    endif()
+
+    if (WOLFSSL_XMSSSMALL)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WC_XMSS_SMALL")
+
+        set_wolfssl_definitions("WOLFSSL_WC_XMSS_SMALL"    RESULT)
+    endif()
+endif()
+
 # SLH-DSA
 add_option(WOLFSSL_SLHDSA
     "Enable the wolfSSL SLH-DSA implementation (default: disabled)"

cmake/options.h.in

@@ -413,6 +413,10 @@ extern "C" {
 #cmakedefine WOLFSSL_HAVE_XMSS
 #undef WOLFSSL_WC_XMSS
 #cmakedefine WOLFSSL_WC_XMSS
+#undef  WOLFSSL_XMSS_VERIFY_ONLY
+#cmakedefine WOLFSSL_XMSS_VERIFY_ONLY
+#undef  WOLFSSL_WC_XMSS_SMALL
+#cmakedefine WOLFSSL_WC_XMSS_SMALL
 #undef HAVE_SECRET_CALLBACK
 #cmakedefine HAVE_SECRET_CALLBACK
 #undef WC_RSA_DIRECT

configure.ac

@@ -1993,7 +1993,7 @@ do
   no)
     ;;
   verify-only)
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY -DXMSS_VERIFY_ONLY"
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XMSS_VERIFY_ONLY"
     ;;
   small)
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_XMSS_SMALL"