Improve some comments, fix some typos+whitespace

include/mbedtls/x509_crt.h

@@ -291,7 +291,7 @@ int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
  *                 chaining up to those CAs will be trusted, and (2)
  *                 self-signed end-entity certificates to be trusted (for
  *                 specific peers you know) - in that case, the self-signed
- *                 certificate doens't need to have the CA bit set.
+ *                 certificate doesn't need to have the CA bit set.
  *
  * \param crt      a certificate (chain) to be verified
  * \param trust_ca the list of trusted CAs (see note above)

library/x509_crt.c

@@ -1893,7 +1893,6 @@ static int x509_crt_check_signature( const mbedtls_x509_crt *child,
  * Return 0 if yes, -1 if not.
  *
  * top means parent is a locally-trusted certificate
- * bottom means child is the end entity cert
  */
 static int x509_crt_check_parent( const mbedtls_x509_crt *child,
                                   const mbedtls_x509_crt *parent,
@@ -1935,9 +1934,9 @@ static int x509_crt_check_parent( const mbedtls_x509_crt *child,
  *  3. for trusted roots, the signature is correct
  *  4. pathlen constraints are satisfied
  *
- * Stop at the first suitable candidate, except if it's not time-valid (not
- * expired nor future) *and* there is a later suitable candidate that is
- * time-valid.
+ * If there's a suitable candidate which is also time-valid, return the first
+ * such. Otherwise, return the first suitable candidate (or NULL if there is
+ * none).
  *
  * The rationale for this rule is that someone could have a list of trusted
  * roots with two versions on the same root with different validity periods.
@@ -1979,7 +1978,7 @@ static mbedtls_x509_crt *x509_crt_find_parent_in( mbedtls_x509_crt *child,
             continue;
         }
 
-        /* optionnal time check */
+        /* optional time check */
         if( mbedtls_x509_time_is_past( &parent->valid_to ) ||
             mbedtls_x509_time_is_future( &parent->valid_from ) )
         {
@@ -2059,7 +2058,7 @@ static int x509_crt_check_ee_locally_trusted(
  *
  * Given a peer-provided list of certificates EE, C1, ..., Cn and
  * a list of trusted certs R1, ... Rp, try to build and verify a chain
- *      EE, Ci1, ... Ciq, Rj
+ *      EE, Ci1, ... Ciq [, Rj]
  * such that every cert in the chain is a child of the next one,
  * jumping to a trusted root as early as possible.
  *
@@ -2074,7 +2073,7 @@ static int x509_crt_check_ee_locally_trusted(
  *  - [in] crt: the cert list EE, C1, ..., Cn
  *  - [in] trust_ca: the trusted list R1, ..., Rp
  *  - [in] ca_crl, profile: as in verify_with_profile()
- *  - [out] ver_chain: the built and verified chain
+ *  - [out] ver_chain, chain_len: the built and verified chain
  *
  * Return value:
  *  - non-zero if the chain could not be fully built and examined
@@ -2167,7 +2166,7 @@ static int x509_crt_verify_chain(
 
 #if defined(MBEDTLS_X509_CRL_PARSE_C)
         /* Check trusted CA's CRL for the given crt */
-        *flags |= x509_crt_verifycrl(child, parent, ca_crl, profile );
+        *flags |= x509_crt_verifycrl( child, parent, ca_crl, profile );
 #else
         (void) ca_crl;
 #endif

tests/scripts/depends-pkalgs.pl

@@ -6,9 +6,10 @@
 #
 # Purpose
 #
-# To test the code dependencies on individual PK algs in each test suite. This
-# is a verification step to ensure we don't ship test suites that do not work
-# for some build options.
+# To test the code dependencies on individual PK algs (those that can be used
+# from the PK layer, so currently signature and encryption but not key
+# exchange) in each test suite. This is a verification step to ensure we don't
+# ship test suites that do not work for some build options.
 #
 # The process is:
 #       for each possible PK alg
@@ -38,6 +39,8 @@ my $ssl_sed = 's/^#define \(MBEDTLS_SSL.*\)/\1/p';
 my $kex_sed = 's/^#define \(MBEDTLS_KEY_EXCHANGE.*\)/\1/p';
 my @ssl = split( /\s+/, `sed -n -e '$ssl_sed' -e '$kex_sed' $config_h` );
 
+# Some algorithms can't be disabled on their own as others depend on them, so
+# we list those reverse-dependencies here to keep check_config.h happy.
 my %algs = (
     'MBEDTLS_ECDSA_C'   => [],
     'MBEDTLS_ECP_C'     => ['MBEDTLS_ECDSA_C', 'MBEDTLS_ECDH_C'],