CMake: uniform the WOLFCRYPT_TZ_PSA flags with options.mk; fix hex version number

[danielinux]

No description provided.

[Copilot]

Copilot review overview

🟡 Changes recommended

The CMake PSA path omits required sources and does not reject hardware DICE without PSA.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Include PSA implementation sources in CMake builds · New
• Reject hardware DICE when PSA is disabled · New

What changed in this PR

Aligns CMake PSA configuration with options.mk and corrects the encoded version number.

Changes:

• Adds wolfPSA includes, definitions, and hardware-DICE handling.
• Corrects version 2.10.0 hexadecimal encoding.

File	Description
CMakeLists.txt	Expands PSA-related CMake configuration.
include/​wolfboot/​version.h	Corrects the hexadecimal version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

PSA builds currently contain invalid source paths, missing crypto dependencies, and incomplete hardware-DICE integration.

Review effort: Balanced
Findings: 4

Open (4)

• DICE prerequisite check mishandles false CMake values · New
• PSA glob paths are duplicated by WOLFBOOT_ROOT prefixing · New
• MCXN DICE CMake target lacks ELS dependencies · New
• PSA CMake build omits required ChaCha source · New

Resolved since last review (2)

• Include PSA implementation sources in CMake builds
• Reject hardware DICE when PSA is disabled

[Copilot]

Copilot review overview

🟡 Changes recommended

PSA CMake builds omit required algorithm sources and lack CI coverage.

Review effort: Balanced
Findings: 1

Open (1)

• Add CMake CI coverage for software PSA and MCXN ELS builds · New

Resolved since last review (4)

• PSA CMake build omits required ChaCha source
• MCXN DICE CMake target lacks ELS dependencies
• PSA glob paths are duplicated by WOLFBOOT_ROOT prefixing
• DICE prerequisite check mishandles false CMake values

Previously missed (1)

In code that hasn't changed since last review

PSA builds omit RSA, ECC, and math fallback sources

lib/​CMakeLists.txt:217

The PSA build still omits the RSA/ECC/math fallback sources that options.mk:1286-1300 adds. For example, an ECC-signed PSA build supplies ECC through SIGN but never compiles rsa.c, even though the secure PSA service supports software RSA and ECC (include/user_settings.h:170-175). Mirror the conditional source selection used by the PKCS11 block so PSA functionality does not depend on the boot signature algorithm.