# Description Update the S2OPC Zephyr platform and embedded samples to support **Zephyr 4.3**. The port must preserve existing OPC UA Client/Server and PubSub functionalities, including secured communication, while adapting the build system and cryptographic integration to the changes introduced in Zephyr 4.3. ## Code version identification * **Target Zephyr version:** Zephyr v4.3.0 * **Reference board:** `stm32h735g_disco` * **Reference application:** `samples/embedded/cli_client` * **S2OPC reference:** current `master` branch after Zephyr 4.2 support * **Reference Zephyr SDK:** v0.17.4 ## Current behavior The existing Zephyr 4.2 integration is not fully compatible with Zephyr 4.3. In particular, changes in the Zephyr build environment and Mbed TLS integration affect the way S2OPC is configured and compiled. The existing configuration relies on assumptions about Mbed TLS configuration files, include paths and Zephyr module integration that are no longer valid or robust with Zephyr 4.3. This may result in configuration or compilation failures, including missing Mbed TLS headers such as `mbedtls/version.h` or `mbedtls/md.h`, incorrect cryptographic source selection, or memory overflow during linking. The port must therefore realign the S2OPC Zephyr integration with the Zephyr 4.3 build and configuration mechanisms. ## Expected behavior S2OPC shall configure, build and run correctly with Zephyr 4.3. The embedded samples shall: * build using the standard Zephyr `west build -b <board>` workflow; * correctly detect S2OPC as an external Zephyr module; * use the Mbed TLS configuration generated by Zephyr/Kconfig; * correctly access the external Mbed TLS public headers; * preserve the cryptographic features required by secured OPC UA communication; * start correctly and expose the expected S2OPC shell commands; * support OPC UA Client/Server communication with UaExpert; * support PubSub communication over UDP; * remain compatible with the existing non-Zephyr S2OPC targets. # Security impact This enhancement affects the integration and configuration of Mbed TLS within the Zephyr platform. No new cryptographic mechanism is introduced. Existing S2OPC security properties must be preserved. The port shall ensure that the Mbed TLS features required by S2OPC, including RSA, PK, PEM and X.509 certificate handling, remain explicitly enabled through the Zephyr-generated configuration and S2OPC-specific user configuration. The change must not introduce embedded credentials, private keys or sensitive data into the repository. # Implementation The following changes are required: * update the Zephyr CMake integration for Zephyr 4.3, including the standard `west build -b <board>` workflow and S2OPC registration through `EXTRA_ZEPHYR_MODULES`; * adapt embedded sample CMake files and remove obsolete build assumptions inherited from the previous Zephyr integration; * update the Mbed TLS integration to use the Zephyr-generated `config-mbedtls.h` while preserving S2OPC-specific cryptographic requirements; * update Mbed TLS Kconfig options, include paths and crypto source selection for Zephyr 4.3; * adapt the Mbed TLS threading and heap configuration, including memory placement on constrained STM32 targets when required; * validate Client/Server communication with UaExpert, including secured communication using certificates and private keys; * validate PubSub UDP communication; * run S2OPC CI and regression tests to ensure that non-Zephyr targets remain unaffected. The implementation should remain limited to changes required for Zephyr support and avoid introducing Zephyr-specific behavior into the common S2OPC code whenever possible.