Merge develop into master (publish)

.github/workflows/ci.yml

@@ -80,7 +80,30 @@
         run: |
           cargo test --target ${{ matrix.target }} --features unit_test --tests
 
+  test-pqc:
+    name: Run ML-KEM and ML-DSA unit tests
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-dev-tools:latest
+    strategy:
+      matrix:
+        target: ["nanox", "nanosplus", "stax", "flex", "apex_p"]
+    steps:
+      - name: Clone
+        uses: actions/checkout@v6
+      - name: Setup C SDK (API_LEVEL_26)
+        run: |
+          git clone https://github.com/LedgerHQ/ledger-secure-sdk --branch API_LEVEL_26 --single-branch /tmp/c_sdk
+      - name: ML-KEM and ML-DSA unit tests
+        working-directory: ledger_device_sdk
+        env:
+          LEDGER_SDK_PATH: /tmp/c_sdk
+          # Shrink the heap for Nano X only, other targets keep the default.
+          HEAP_SIZE: "nanox: 2048"
+        run: |
+          cargo test --target ${{ matrix.target }} --features unit_test,mlkem,mldsa --tests
+
   build-apps:
     name: Build all Rust apps
     if: github.event_name != 'workflow_dispatch'
     uses: ./.github/workflows/reusable_build_all_apps.yml

ledger_device_sdk/Cargo.toml

@@ -40,6 +40,10 @@ nano_nbgl = [ "ledger_secure_sdk_sys/nano_nbgl" ]
 debug_csdk = [ "ledger_secure_sdk_sys/debug_csdk" ]
 io_new = []  # switch to new 'io' module
 stack_usage = []
+mlkem = [ "ledger_secure_sdk_sys/mlkem" ]
+mldsa = [ "ledger_secure_sdk_sys/mldsa" ]
+mldsa_87 = [ "mldsa", "ledger_secure_sdk_sys/mldsa_87" ]
+mldsa_optimization = [ "mldsa", "ledger_secure_sdk_sys/mldsa_optimization" ]
 
 # Build a network/app variant. When enabled, build.rs overlays the
 # [package.metadata.ledger.variants.x] table onto the base

ledger_device_sdk/src/lib.rs

@@ -30,6 +30,10 @@ pub mod io {
 pub mod libcall;
 pub mod log;
 pub mod math;
+#[cfg(feature = "mldsa")]
+pub mod mldsa;
+#[cfg(feature = "mlkem")]
+pub mod mlkem;
 pub mod nvm;
 pub mod pki;
 pub mod random;