{"action":"created","issue":{"url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/9984","repository_url":"https://api.github.com/repos/zephyrproject-rtos/zephyr","labels_url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/9984/labels{/name}","comments_url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/9984/comments","events_url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/9984/events","html_url":"https://github.com/zephyrproject-rtos/zephyr/pull/9984","id":360255491,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE1NTU1ODg3","number":9984,"title":"ext: lib: crypto: Added feature allowing external mbedTLS Kconfig","user":{"login":"nordic-doki","id":41985979,"node_id":"MDQ6VXNlcjQxOTg1OTc5","avatar_url":"https://avatars3.githubusercontent.com/u/41985979?v=4","gravatar_id":"","url":"https://api.github.com/users/nordic-doki","html_url":"https://github.com/nordic-doki","followers_url":"https://api.github.com/users/nordic-doki/followers","following_url":"https://api.github.com/users/nordic-doki/following{/other_user}","gists_url":"https://api.github.com/users/nordic-doki/gists{/gist_id}","starred_url":"https://api.github.com/users/nordic-doki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nordic-doki/subscriptions","organizations_url":"https://api.github.com/users/nordic-doki/orgs","repos_url":"https://api.github.com/users/nordic-doki/repos","events_url":"https://api.github.com/users/nordic-doki/events{/privacy}","received_events_url":"https://api.github.com/users/nordic-doki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-14T10:51:08Z","updated_at":"2018-09-19T13:01:49Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/pulls/9984","html_url":"https://github.com/zephyrproject-rtos/zephyr/pull/9984","diff_url":"https://github.com/zephyrproject-rtos/zephyr/pull/9984.diff","patch_url":"https://github.com/zephyrproject-rtos/zephyr/pull/9984.patch"},"body":"This changes allows to configure mbedTLS from different Kconfig and CMakeLists.txt files. This will be useful if other software (e.g. downloaded with the west tool) want to provided its own mbedTLS library with completely different configuration. Current way of configuring it is not convenient for user, because he have to manually put library path. Additionally currently all mbedTLS library files (includes, binaries and config header) must be in single directory."},"comment":{"url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/comments/422793998","html_url":"https://github.com/zephyrproject-rtos/zephyr/pull/9984#issuecomment-422793998","issue_url":"https://api.github.com/repos/zephyrproject-rtos/zephyr/issues/9984","id":422793998,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMjc5Mzk5OA==","user":{"login":"aurel32","id":7688913,"node_id":"MDQ6VXNlcjc2ODg5MTM=","avatar_url":"https://avatars0.githubusercontent.com/u/7688913?v=4","gravatar_id":"","url":"https://api.github.com/users/aurel32","html_url":"https://github.com/aurel32","followers_url":"https://api.github.com/users/aurel32/followers","following_url":"https://api.github.com/users/aurel32/following{/other_user}","gists_url":"https://api.github.com/users/aurel32/gists{/gist_id}","starred_url":"https://api.github.com/users/aurel32/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aurel32/subscriptions","organizations_url":"https://api.github.com/users/aurel32/orgs","repos_url":"https://api.github.com/users/aurel32/repos","events_url":"https://api.github.com/users/aurel32/events{/privacy}","received_events_url":"https://api.github.com/users/aurel32/received_events","type":"User","site_admin":false},"created_at":"2018-09-19T13:01:49Z","updated_at":"2018-09-19T13:01:49Z","author_association":"COLLABORATOR","body":"(@nordic-doki, sorry for the long message, it is not targeted your PR directly, it just it triggered some more general thinking)\r\n\r\nOverall, I have the impression that all the mbedTLS configuration in Zephyr is becoming quite complex and that each of the recent changes are just done to fulfil a specific need instead of making it really configurable to fulfil as many needs as possible.\r\n\r\nRight now for the internal mbedTLS configuration, we have two global Kconfig options concerning the HEAP, and a way to choose between different configuration files. The different configuration files do not seem very consistent, for instance some of them define `MBEDTLS_AES_ROM_TABLES` and some others not. It's even worse with `MBEDTLS_HAVE_ASM` which is sometimes defined, sometimes not, and sometimes only on !ARM. Both of these options should be typically configured at the application level as they are just a trade-off between RAM, ROM and speed, and that greatly depends on the chosen MCU and the applications needs. Those are just two examples, there are many other similar inconsistencies. Note also that it's not easy to use an out-of-tree (i.e. application specific) mbedTLS configuration file as the `MBEDTLS_CFG_FILE` is either a path relative to `ext/lib/crypto/mbedtls/configs` or an absolute path.\r\n\r\nThe recent addition of the `config-tls-generic.h` file is probably one step in the right direction, that said as its name suggests it's still TLS specific. Despite its name mbedTLS can be useful for other things than TLS connection, it can also be used for the hash computation, or for (a)symmetric cryptography, for instance validating the signature of code or data.\r\n\r\nTo satisfy all users, Zephyr should provide the possibility to fine tune mostl mbedTLS options or parameters. It could be done by mapping most mbedTLS options to a Kconfig option, and/or by giving the possibility to use an out-of-tree mbedTLS configuration file. I am not sure what would be the best option.\r\n\r\n@nordic-doki, from what I understand you would like to be able to use the mbedTLS sources that are shipped by Zephyr, but with an out-of-tree configuration. Is that correct? Would it work if you were able to provide an out-of-tree mbedTLS configuration file used to build mbedTLS?"}}
{"actor":{"display_login":"aurel32"}}