Support external-mu (extmu) ML-DSA variants in Signature wrapper and tests

[dstebila]

Background

liboqs main now enables external-mu ML-DSA variants: ML-DSA-44-extmu, ML-DSA-65-extmu, and ML-DSA-87-extmu. These are returned by get_enabled_sig_mechanisms().

Unlike standard ML-DSA, the external-mu variants cannot be signed through the normal OQS_SIG_sign path — they expect an externally-computed µ (mu = H(pk_hash || M')) rather than a raw message. As a result, the generic correctness tests in tests/test_sig.py, which iterate over all enabled mechanisms and call plain sig.sign(message), fail with:

'ML-DSA-44-extmu' ... ERROR
RuntimeError: Can not sign message

This currently breaks the "GitHub actions simplified" CI workflow (which builds liboqs from main HEAD because the package version is a dev version).

Immediate mitigation

A separate PR excludes the extmu variants from the generic sign/verify tests (adds "extmu" to disabled_sig_patterns) to unblock CI. That is a stopgap — it leaves the new algorithms untested.

What this issue tracks

Proper support for the external-mu variants:

1. Add an external-mu signing/verification path to the Signature wrapper (binding the relevant liboqs external-mu API, e.g. OQS_SIG_sign_with_ctx_str / dedicated extmu entry points as exposed by liboqs), including computing/accepting the µ value.
2. Add dedicated tests for the -extmu variants that exercise this path, mirroring how liboqs's own test harness handles external-mu signing.
3. Remove the "extmu" entry from disabled_sig_patterns once real coverage exists.

🤖 Generated with Claude Code