feat: seal stored records with HMAC-SHA256 instead of CRC-16

[DavidCozens]

Pull request

What this stage adds

SolidSyslogMbedTlsHmacSha256Policy replaces SolidSyslogCrc16Policy on the store.
Records at rest are tamper-evident rather than checksummed: an edit without the key
fails verification, and Open compares in constant time.

Flash +13,424 B (+348 on the previous stage)
RAM +35,684 B (+20)
Log stack +712 B (unchanged)
Service +3,800 B (unchanged)

Twenty bytes, and it is the policy's pool entry — nothing else. The mechanism for
holding a named symmetric key and handing it out is the device's own: a device
already doing mTLS has provisioned secrets and somewhere to keep them, so the key
slot, the loader and the accessor all sit below the line. What SolidSyslog is
charged for is the policy and the callback that reaches for the key.

No stack movement and no heap: SHA-256 was already linked, and the policy hashes
into a caller-owned buffer.

The key is fetched per seal and per verify rather than held, so it never sits on
the policy instance.

Files

 README.md               | 14 +++++++-------
 app/syslog/Syslog.c     | 15 +++++++++++++--
 measurements/hmac.csv   | 13 +++++++++++++
 measurements/stages.tsv |  1 +
 run-report.md           | 30 +++++++++++++++---------------
 5 files changed, 49 insertions(+), 24 deletions(-)

Checklist

• The diff is application-only — no change to board bring-up, config headers, or build infra.
• measurements/hmac.csv committed.
• Row added to measurements/stages.tsv.
• README regenerated: python3 scripts/gen-cost-table.py.
• ./run.sh green (build + QEMU + baseline self-check) — run-report.md committed.

---

Context for review: 17 of 21 sequential single-commit PRs replaying the integration on top of the Baseline root. Each lands green and reviewed before the next is built on it, because a change to an early commit would force every commit above it to be re-run and re-measured.

Summary by CodeRabbit

• New Features

  • Added HMAC-SHA256 authentication for stored syslog records to help detect tampering.
  • HMAC keys are securely retrieved from the device’s provisioned key store when records are sealed or verified.

• Documentation

  • Updated storage-stage descriptions, resource cost estimates, and example run reports to reflect HMAC-at-rest protection.

[coderabbitai]

📝 Walkthrough

Walkthrough

Syslog persistent-store authentication changes from CRC16 to HMAC-SHA256 using a symmetric key fetched from DeviceCertStore. README and run-report documentation now describe the HMAC stage and updated measurements.

Changes

HMAC at-rest sealing

Layer / File(s)	Summary
Store HMAC policy wiring app/syslog/Syslog.c	Replaces the CRC16 policy with Mbed TLS HMAC-SHA256 and retrieves the store key through DeviceCertStore.
HMAC documentation and measurements README.md, run-report.md	Updates stage descriptions, cost figures, build totals, and HMAC self-check output.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Syslog_Start
  participant HMACPolicy as HMAC-SHA256 Policy
  participant SyslogStoreKey
  participant DeviceCertStore
  Syslog_Start->>HMACPolicy: configure store authentication
  HMACPolicy->>SyslogStoreKey: request symmetric key
  SyslogStoreKey->>DeviceCertStore: fetch provisioned store key
  DeviceCertStore-->>SyslogStoreKey: return key material
  SyslogStoreKey-->>HMACPolicy: provide key for sealing or verification

Loading

Possibly related PRs

• cososo-ltd/solid-syslog-example#12: Adds the DeviceCertStore plumbing used by this HMAC key retrieval.
• cososo-ltd/solid-syslog-example#21: Adds related DeviceCertStore key storage and HMAC policy wiring.
• cososo-ltd/solid-syslog-example#22: Directly overlaps the CRC16-to-HMAC store-policy transition.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: replacing CRC-16 with HMAC-SHA256 for stored-record sealing.
Description check	✅ Passed	The description follows the template with the required stage summary and a complete checklist for application-only, measurements, README, and run.sh.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch stage/hmac

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@run-report.md`:
- Around line 50-62: Extend the self-check scenario in run-report.md beyond the
TLS delivery and resource counters to exercise an offline/store write and read
using the new key callback, then tamper with the stored record and verify it is
rejected with the expected HMAC verification failure. Document the resulting
store-path output alongside the existing report evidence.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 655d9d11-8caa-44a4-9802-2d06dbae7d44

📥 Commits

Reviewing files that changed from the base of the PR and between a079767 and 7569679.

⛔ Files ignored due to path filters (2)

• measurements/hmac.csv is excluded by !**/*.csv
• measurements/stages.tsv is excluded by !**/*.tsv

📒 Files selected for processing (3)

• README.md
• app/syslog/Syslog.c
• run-report.md