tests: make 'make check' pass on the source-only (WITH_SDK=0) build

The SDK-mode regression tests (audit, F-08/F-10/F-11/F-12, pq-box, KDF
transparency) now skip cleanly when built without libzuptsdk, and the
constant-time test links libzuptsdk only when present (its primitives are
native). Also drop a dead 'seqs_decoded' variable in vv_ans.c that failed
the exact-size test's -Werror=unused-but-set-variable. 'make check' is
green source-only, so the openSUSE %check no longer blocks the build.

src/vv_ans.c

@@ -2330,7 +2330,6 @@ vva_error_t vva_decode_sequences_impl(const uint8_t *src, size_t src_len,
                            ? op_end - SAFEZONE_RESERVE : dst;
     const uint8_t *offset_check_floor = dst_base + SAFEZONE_MAX_OFFSET;
 
-    size_t seqs_decoded = 0;
     /* SPRINT 90 SECURITY FIX (DoS hardening):
      *
      * The original loop terminated only when both lit_pos reached
@@ -2454,7 +2453,6 @@ vva_error_t vva_decode_sequences_impl(const uint8_t *src, size_t src_len,
             op += litlen;
             lit_pos += litlen;
         }
-        seqs_decoded++;
 
         /* SPRINT 63/64: continue the loop even when all matches are
          * consumed, as long as literals remain. Previously this broke

tests/test_audit.sh

@@ -5,6 +5,14 @@
 # Each property is checked via TWO independent paths.
 
 ZUPT_BIN="$(realpath ./zupt)"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$ZUPT_BIN" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 TMPDIR=$(mktemp -d)
 trap "rm -rf $TMPDIR" EXIT
 cd "$TMPDIR"

tests/test_ct_timing.sh

@@ -24,12 +24,19 @@ else
 fi
 
 TMP=$(mktemp -d)
+# This test uses only native CT primitives (zupt_ct_memeq, ML-KEM CT compare);
+# the libzuptsdk linkage is vestigial. Link it only when the vendored library
+# is present (WITH_SDK builds); source-only builds compile+run without it.
+SDK_LINK=""
+if ls "$SDK_DIR"/libzuptsdk.so* >/dev/null 2>&1; then
+    SDK_LINK="-L$SDK_DIR -lzuptsdk -Wl,-rpath,$(cd "$SDK_DIR" && pwd)"
+fi
 if gcc -Iinclude -Isrc -I"$SDK_DIR/include" -Wall -Wextra -Werror $SHANI -O2 -std=c11 \
        tests/test_ct_timing.c \
        src/zupt_crypto.c src/zupt_sha256.c src/zupt_sha256_shani.c src/zupt_aes256.c \
        src/zupt_xxh.c src/zupt_keccak.c src/zupt_x25519.c src/zupt_mlkem.c \
        src/zupt_cpuid.c src/zupt_mlock.c \
-       -L"$SDK_DIR" -lzuptsdk -Wl,-rpath,"$(cd "$SDK_DIR" && pwd)" -lm \
+       $SDK_LINK -lm \
        -o "$TMP/t" 2>"$TMP/cc.log"; then
     "$TMP/t"; rc=$?
 else

tests/test_f08_topmac.sh

@@ -18,6 +18,14 @@ set -u
 PASS=0
 FAIL=0
 ZUPT="${ZUPT_BIN:-./zupt}"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 # Resolve to absolute path so the test continues to find the binary after cd.
 case "$ZUPT" in
     /*) ;;

tests/test_f10_kdf_default.sh

@@ -19,6 +19,14 @@
 set -u
 
 ZUPT="${ZUPT_BIN:-./zupt}"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 case "$ZUPT" in
     /*) ;;
     *)  ZUPT="$PWD/$ZUPT" ;;

tests/test_f11_authfail_message.sh

@@ -19,6 +19,14 @@
 set -u
 
 ZUPT="${ZUPT_BIN:-./zupt}"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 case "$ZUPT" in
     /*) ;;
     *)  ZUPT="$PWD/$ZUPT" ;;

tests/test_f12_comment.sh

@@ -27,6 +27,14 @@
 set -u
 
 ZUPT="${ZUPT_BIN:-./zupt}"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 case "$ZUPT" in
     /*) ;;
     *)  ZUPT="$PWD/$ZUPT" ;;

tests/test_kdf_transparency.sh

@@ -7,6 +7,14 @@
 
 set -u
 SDK_DIR="${ZUPTSDK_DIR:-vendor/zuptsdk}"
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! ls "$SDK_DIR"/libzuptsdk.so* >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 ARCH=$(uname -m)
 if [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i686" ]; then
     SHANI="-msha -mssse3 -msse4.1"

tests/test_pqbox.sh

@@ -14,6 +14,14 @@ bad() { echo "  ✗ $1"; F=$((F+1)); }
 T=$(mktemp -d)
 FX=/tmp/bench/fixtures
 BIN=./vaptvupt
+# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
+# test exercises are unavailable, so skip cleanly instead of failing.
+_sdkck="$(mktemp -d)"
+if ! "$BIN" keygen --box -o "$_sdkck/p" >/dev/null 2>&1; then
+    rm -rf "$_sdkck"; echo "  SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
+fi
+rm -rf "$_sdkck"
+
 
 echo "pq-box mode (ZUPT_ENC_PQ_BOX_V1)"