Resolve WOLFSSL_TAG default dynamically instead of hand-bumping

The hardcoded v5.8.4-stable default kept the 'default' FIPS scripts test
config pinned to an old wolfSSL whose headers no longer satisfy the v5.2.4
FIPS overlay (XXX-fips-test references WC_MIN_DIGEST_SIZE, which only
exists from v5.9.0-stable on). Rather than play tag-bump roulette every
release, walk a small resolution ladder:

  1. WOLFSSL_TAG (explicit caller override) - unchanged
  2. WOLFSSL_LATEST - set by the Jenkinsfile 'Resolve versions' stage, so
     CI gets the dynamic value with zero extra HTTP cost
  3. GitHub releases/latest API - for local dev runs without Jenkins
  4. v5.9.1-stable hardcoded floor - only used if all of the above fail
     (e.g. GitHub unreachable), so the script remains buildable offline

Author: aidangarske

scripts/utils-wolfssl.sh

@@ -22,7 +22,22 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 source ${SCRIPT_DIR}/utils-general.sh
 
 WOLFSSL_GIT=${WOLFSSL_GIT:-"https://github.com/wolfSSL/wolfssl.git"}
-WOLFSSL_TAG=${WOLFSSL_TAG:-"v5.8.4-stable"}
+# Resolve WOLFSSL_TAG dynamically so we don't have to hand-bump on every release.
+# Order: explicit WOLFSSL_TAG (caller override) -> WOLFSSL_LATEST (Jenkins "Resolve
+# versions" stage already sets this with zero extra HTTP cost) -> GitHub releases
+# API (for local runs without Jenkins) -> hardcoded floor as a last-resort safety
+# net in case GitHub is unreachable.
+if [ -z "$WOLFSSL_TAG" ]; then
+    if [ -n "$WOLFSSL_LATEST" ]; then
+        WOLFSSL_TAG="$WOLFSSL_LATEST"
+    else
+        WOLFSSL_TAG=$(curl -fsSL https://api.github.com/repos/wolfSSL/wolfssl/releases/latest 2>/dev/null \
+            | grep -oE '"tag_name"[[:space:]]*:[[:space:]]*"[^"]+"' \
+            | head -1 \
+            | sed -E 's/.*"([^"]+)"$/\1/')
+    fi
+fi
+WOLFSSL_TAG="${WOLFSSL_TAG:-v5.9.1-stable}"
 WOLFSSL_SOURCE_DIR=${SCRIPT_DIR}/../wolfssl-source
 WOLFSSL_INSTALL_DIR=${SCRIPT_DIR}/../wolfssl-install
 WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS:-0}