CMake: fix XMSS wiring and complete LMS/XMSS sub-option parity

[Frauschi]

Problem

The CMake build accepted -DWOLFSSL_XMSS=1 but never emitted WOLFSSL_HAVE_XMSS — neither onto the library compile line nor into the installed options.h. Since every XMSS body is wrapped in #ifdef WOLFSSL_HAVE_XMSS, the option was a no-op: wc_xmss.c compiled empty and consumers saw no XMSS support. LMS had the correct wiring. Autotools (--enable-xmss) was unaffected.

While fixing this, CMake was also missing several LMS sub-options that autotools --enable-lms already supports.

Changes

XMSS (build-break fix) — 32ab46a

• CMakeLists.txt — add the missing if (WOLFSSL_XMSS) block (mirroring LMS), plus WOLFSSL_XMSSVERIFYONLY / WOLFSSL_XMSSSMALL sub-options for parity with autotools --enable-xmss=verify-only,small.
• cmake/options.h.in — expose WOLFSSL_XMSS_VERIFY_ONLY and WOLFSSL_WC_XMSS_SMALL.
• configure.ac — drop the unused legacy XMSS_VERIFY_ONLY macro (the un-prefixed twin is dead in-tree), so both build systems emit only WOLFSSL_XMSS_VERIFY_ONLY.
• .github/workflows/cmake.yml — enable WOLFSSL_XMSS in the main CMake CI build (it tested LMS but not XMSS — the blind spot that let this through).

LMS (parity follow-on) — f377a54

• Add the three LMS sub-options CMake lacked: WOLFSSL_LMSVERIFYONLY, WOLFSSL_LMSSMALL, WOLFSSL_LMSSHAKE256 (emitting WOLFSSL_LMS_VERIFY_ONLY, WOLFSSL_WC_LMS_SMALL, WOLFSSL_LMS_SHAKE256), matching autotools --enable-lms=verify-only,small,shake256.

Verification

• -DWOLFSSL_XMSS=1 → options.h now emits #define WOLFSSL_HAVE_XMSS; wc_XmssKey_* symbols exported (were absent before).
• Both verify-only builds drop wc_{Xmss,Lms}Key_Sign/MakeKey, keep Verify — matches autotools.
• Sub-options don't leak into options.h when their parent (WOLFSSL_XMSS / WOLFSSL_LMS) is off.
• Generated options.h no longer contains the dead bare XMSS_VERIFY_ONLY.

Downstream

Unblocks wolfPKCS11 #206, whose CMake CI clones wolfSSL master and requires WOLFSSL_HAVE_XMSS.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Frauschi]

Jenkins retest this please

[Copilot]

Pull request overview

This PR fixes CMake’s XMSS enablement so -DWOLFSSL_XMSS=1 actually results in WOLFSSL_HAVE_XMSS being defined (and emitted into the generated/installed options.h), and extends CMake to support the same LMS/XMSS “verify-only” and “small”/variant sub-options that autotools already supports. It also closes a CI gap by enabling XMSS in the primary CMake workflow.

Changes:

• Wire WOLFSSL_XMSS in CMake to emit WOLFSSL_HAVE_XMSS, plus add XMSS sub-options for verify-only and small.
• Add missing CMake LMS sub-options for verify-only, small, and shake256, matching autotools behavior.
• Remove the legacy unprefixed XMSS_VERIFY_ONLY define from autotools, and enable XMSS in the main CMake GitHub Actions job.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
configure.ac	Removes the unused legacy -DXMSS_VERIFY_ONLY so autotools emits only WOLFSSL_XMSS_VERIFY_ONLY.
CMakeLists.txt	Adds XMSS wiring (WOLFSSL_HAVE_XMSS) and completes LMS/XMSS sub-option parity (verify-only/small/shake256).
cmake/options.h.in	Exposes new LMS/XMSS sub-option macros to generated options.h for CMake builds.
.github/workflows/cmake.yml	Enables -DWOLFSSL_XMSS in the main CMake CI build to prevent regressions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.