Add chain verify callback example

[julek-wolfssl]

Adds a TLS client example demonstrating an external root of trust: no CA is loaded into the wolfSSL context, and a chain verify callback instead hands the server's certificate chain to a trust service running on its own thread (standing in for an HSM holding the anchors). The handshake is deferred with CHAIN_VERIFY_WANT_E until the service returns a verdict.

• Includes switches to demonstrate the handshake failing when no callback is installed and when the trust service rejects the chain.
• Requires wolfSSL built with --enable-chain-verify-cb.

[julek-wolfssl]

Depends on wolfSSL/wolfssl#11367

[Copilot]

🟡 Changes recommended

The new example has confirmed correctness issues (undefined symbol, resource cleanup leaks, and unsafe thread/library cleanup ordering) that can break builds or cause runtime hazards.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new TLS client example demonstrating wolfSSL’s chain verify callback mechanism to support an external “root of trust” (e.g., an HSM-like trust service), and documents how to build/run it.

Changes:

• Added client-tls-chainverifycb example implementing deferred handshake verification via CHAIN_VERIFY_WANT_E and a background “trust service” thread.
• Updated tls/README.md with build/run instructions and expected outputs for the new example and its demo switches.
• Updated build/ignore plumbing (tls/Makefile, .gitignore) for the new example binary.

File summaries

File	Description
tls/README.md	Documents the new chain verify callback example and how to build/run it.
tls/Makefile	Ensures the new example is built with -pthread.
tls/client-tls-chainverifycb.c	New client example implementing deferred verification via chain verify callback and a trust-service thread.
.gitignore	Ignores the newly built client-tls-chainverifycb binary.

Review details

Suppressed comments (1)

tls/client-tls-chainverifycb.c:183

• If pthread_create() fails, service_start() returns without cleaning up the mutex/cond or freeing svc->anchor, which leaks resources and leaves service_stop() unsafe if it were called later. Clean up before returning.

    pthread_mutex_init(&svc->lock, NULL);
    pthread_cond_init(&svc->cond, NULL);
    if (pthread_create(&svc->thread, NULL, service_thread, svc) != 0) {
        fprintf(stderr, "trust service: cannot start thread\n");
        return -1;
    }

• Files reviewed: 3/4 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.