From 25b4e72d6ee7f148bc3d679964b6f28d2b980df1 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 27 Jul 2023 15:05:12 +0200 Subject: [PATCH] MBEDTLS_PSA_CRYPTO_CONFIG is ready for production It's ok if people use MBEDTLS_PSA_CRYPTO_CONFIG: it's not unstable or unpredictable. But we still reserve the right to make minor changes (e.g. https://github.com/Mbed-TLS/mbedtls/issues/7439). Signed-off-by: Gilles Peskine --- include/mbedtls/mbedtls_config.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h index 30e4d13ece..a85ba94e70 100644 --- a/include/mbedtls/mbedtls_config.h +++ b/include/mbedtls/mbedtls_config.h @@ -1998,8 +1998,15 @@ * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies * an alternative header to include instead of include/psa/crypto_config.h. * - * This feature is still experimental and is not ready for production since - * it is not completed. + * \warning This option is experimental, in that the set of `PSA_WANT_XXX` + * symbols is not completely finalized yet, and the configuration + * tooling is not ideally adapted to having two separate configuration + * files. + * Future minor releases of Mbed TLS may make minor changes to those + * symbols, but we will endeavor to provide a transition path. + * Nonetheless, this option is considered mature enough to use in + * production, as long as you accept that you may need to make + * minor changes to psa/crypto_config.h when upgrading Mbed TLS. */ //#define MBEDTLS_PSA_CRYPTO_CONFIG