Add TPM-backed X.509 host certificate support and fix TPM-build client auth

[aidangarske]

Description

• Add tpm backed x509 host cert support for tpm builds
• minor change and fixes a TPM-build regression where clients could not perform password/keyboard-interactive authentication.
• CI test for matrix x509 added

support for ZD 22094

[Copilot]

Pull request overview

Adds TPM-backed X.509 host-certificate support for wolfSSH servers (non-exportable TPM private key, certificate-based server identity verification) and fixes a TPM-build regression where clients could not perform password/keyboard-interactive authentication.

Changes:

• Fixes client auth-method selection so --enable-tpm builds still handle password/keyboard-interactive, with TPM publickey auth preferred when a TPM key is configured.
• Adds examples/tpmcertserver/ demonstrating a TPM-resident host key presented via an X.509 certificate, plus a minimal verifying client.
• Extends CI (tpm-ssh.yml) and documentation (README.md) to cover the new X.509 host-certificate flow.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/internal.c	Fixes TPM-related auth-method handling and adds TPM publickey preference logic.
README.md	Documents how to run a TPM-backed X.509 host-certificate server/client flow.
examples/tpmcertserver/tpmcertserver.c	New example server: creates TPM key, generates self-signed cert, serves with TPM host key + cert.
examples/tpmcertserver/tpmcertclient.c	New example client: loads CA, restricts hostkey algos to x509, connects and performs echo.
examples/tpmcertserver/include.am	Builds the new example programs under the appropriate feature gates.
examples/tpmcertserver/.gitignore	Ignores built example binaries and generated cert output.
examples/include.am	Includes the new example directory in the examples build.
.github/workflows/tpm-ssh.yml	Adds matrix coverage and runs positive/negative X.509 TPM-host-certificate tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 5 total — 5 posted, 0 skipped
5 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] TPM publickey preference has no fallback to password/keyboard on failure — src/internal.c:16420-16431
• [Medium] TpmCcLoadFile silently truncates CA files larger than the buffer — examples/tpmcertserver/tpmcertclient.c:70-89
• [Low] sigType/subject may trigger -Wmaybe-uninitialized — examples/tpmcertserver/tpmcertserver.c:87-91
• [Low] Example server compares password with non-constant-time XMEMCMP — examples/tpmcertserver/tpmcertserver.c:69-72
• [Low] Negative CI test can false-pass on server startup failure — .github/workflows/tpm-ssh.yml:169-190

Review generated by Skoll

[dgarske]

#1081 (review)