Bump version to v4.2.0 and add the 4.2.0 ChangeLog

CMakeLists.txt

@@ -21,7 +21,7 @@
 
 cmake_minimum_required(VERSION 3.16)
 
-project(wolfTPM VERSION 4.1.0 LANGUAGES C)
+project(wolfTPM VERSION 4.2.0 LANGUAGES C)
 
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)
 set(WOLFTPM_DEFINITIONS)

ChangeLog.md

@@ -1,5 +1,77 @@
 # Release Notes
 
+## wolfTPM Release 4.2.0 (Sep 9, 2026)
+
+**Summary**
+
+Feature and maintenance release centered on TCG TPM 2.0 v1.85 specification
+compliance in the firmware TPM (fwTPM), expanded post-quantum support, and new
+platform backends. Highlights: a broad set of fwTPM v1.85 compliance fixes
+(command attributes, PolicyAuthorize, context-blob authentication, NV
+authorization, ticket HMAC ordering), plus SPDM responder corrections;
+ML-DSA authentication for post-quantum TLS 1.3 and SealSQ QVault post-quantum
+TPM support; wolfHAL I2C/SPI backends and NVIDIA Jetson Orin OP-TEE fwTPM
+support; ST33 firmware-update corrections; transport and NV/hash performance
+improvements; and extensive security hardening (Fenrir, Coverity, negative
+tests).
+
+**Detail**
+
+* Firmware TPM (fwTPM) TCG v1.85 specification compliance
+  - Command-code masking and vendor-bit return-code fix (PR #556)
+  - Corrected auth-entry handling (PR #566)
+  - PolicyAuthorize compliance fixes and corrected response codes for the
+    keySign name ticket and approvedPolicy (PRs #567, #572)
+  - Authenticate object context blobs on ContextSave/ContextLoad (PR #568)
+  - Reject unsupported LoadExternal private types, fix creation-ticket HMAC
+    ordering, and validate ML-DSA / ML-KEM templates in LoadExternal and
+    CreateLoaded (PRs #573, #578)
+  - Validate NV space authorization and report the v1.85 revision (PR #575)
+  - Fix hierarchy and policy-authorization gaps and SPDM responder version
+    negotiation (PR #577)
+  - Correct command-attribute reporting and the verified-ticket HMAC algorithm
+    (PR #579)
+  - Additional TCG v1.85 fwTPM and SPDM compliance fixes (PR #584)
+* Post-quantum and TLS
+  - TPM-backed ML-DSA authentication for post-quantum TLS 1.3, with an example
+    and tests (PR #559)
+  - SealSQ QVault post-quantum TPM support (PR #570)
+* New platform and HAL support
+  - wolfHAL I2C and SPI backends, enabled with `--enable-wolfhal` and an
+    application-supplied `board.h` (PR #562)
+  - NVIDIA Jetson Orin (Tegra234) OP-TEE firmware TPM, reached through the
+    Linux TPM kernel driver as `/dev/tpmrm0` (PR #576)
+  - Finer per-command-group gating macros in the fwTPM (PR #574)
+  - Caller-supplied policy authorization for firmware upgrade (PR #560)
+* ST33 firmware update
+  - Fix Generation 1 manifest size and refuse oversized commands (PR #583)
+  - Select ST33 field-upgrade commands from the TPM command set (PR #586)
+* Performance
+  - Reuse transport connections and reduce NV-write and hash-cache overhead
+    (PR #563)
+* Security hardening (Fenrir, Coverity, input validation)
+  - Harden the crypto callback, ASN.1 parsing, parameter encryption, and
+    marshalling, with negative tests (PR #551)
+  - Bound the TPM2 response decrypt-parameter size, zeroize primary-key auth,
+    and expand marshalling/import test coverage (PR #555)
+  - Guard a tainted PCR-select copy in the fwTPM properties path (PR #558)
+  - Fix a fwTPM response buffer overflow and an SPDM clear-frame command bypass
+    (PR #561)
+  - Harden wolfTPM2 PCR/hash wrapper validation (PR #554)
+  - Strengthen TPM input validation and memory handling (PR #565)
+  - Fix a wolfCrypt refcount race in P521 primary derivation and a policy-session
+    authorization bypass (PR #571)
+  - Harden PCR policy bounds checks (PR #581)
+  - Harden wolfTPM validation and data handling (PR #582)
+  - Harden fwTPM protocol handling and SPDM authentication (PR #588)
+* Build fixes
+  - Fix AES_BLOCK_SIZE undeclared under OPENSSL_COEXIST wolfSSL (PR #552)
+  - Fix an edge-case build with TIS lock and no wolfCrypt (PR #564)
+* Documentation and licensing
+  - Add contribution guidance (CONTRIBUTING.md) (PR #569)
+  - GPLv2 exception to the base GPLv3 license: wolfTPM combined with U-Boot
+    from Cisco Systems, Inc. may be licensed under GPLv2 (PR #557)
+
 ## wolfTPM Release 4.1.0 (Jul 10, 2026)
 
 **Summary**

configure.ac

@@ -3,7 +3,7 @@
 # All right reserved.
 
 AC_COPYRIGHT([Copyright (C) 2014-2026 wolfSSL Inc.])
-AC_INIT([wolftpm],[4.1.0],[https://github.com/wolfssl/wolfTPM/issues],[wolftpm],[https://www.wolfssl.com])
+AC_INIT([wolftpm],[4.2.0],[https://github.com/wolfssl/wolfTPM/issues],[wolftpm],[https://www.wolfssl.com])
 
 AC_PREREQ([2.63])
 AC_CONFIG_AUX_DIR([build-aux])
@@ -29,7 +29,7 @@ AC_ARG_PROGRAM
 
 AC_CONFIG_HEADERS([src/config.h])
 
-WOLFTPM_LIBRARY_VERSION=18:0:0
+WOLFTPM_LIBRARY_VERSION=19:0:0
 #                        | | |
 #                 +------+ | +---+
 #                 |        |     |

wolftpm/version.h

@@ -34,8 +34,8 @@
 extern "C" {
 #endif
 
-#define LIBWOLFTPM_VERSION_STRING "4.1.0"
-#define LIBWOLFTPM_VERSION_HEX 0x04010000
+#define LIBWOLFTPM_VERSION_STRING "4.2.0"
+#define LIBWOLFTPM_VERSION_HEX 0x04002000
 
 #ifdef __cplusplus
 }