Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The checker accepts mismatched version suffixes in both the PURL and README.
1 open issue
What changed in this PR
Adds machine-readable wolfPSA release metadata for Zephyr SBOM identification and CI version consistency checks.
Changes:
- Declares the wolfPSA PURL in Zephyr metadata.
- Adds public version macros in a distinctively named header.
- Checks release metadata and pushed tags against the header.
| File | Description |
|---|---|
| zephyr/module.yml | Adds the versioned wolfPSA PURL. |
| wolfpsa/wolfpsa_version.h | Defines string and hexadecimal version macros. |
| .github/workflows/version-check.yml | Runs version validation on pushes and pull requests. |
| .github/scripts/check-version.sh | Checks release metadata and tag consistency. |
Review effort: Balanced
Zephyr's west spdx records a module's identifiers in modules-deps.spdx only from the security: external-references list in zephyr/module.yml. wolfPSA had none, so an SBOM made with west spdx gave a vulnerability scanner nothing to match the wolfPSA sources against. Add the pkg:github PURL of the v5.9.4 release, in the form the wolfSSL SBOM tooling emits. There is no CPE: NVD does not list wolfPSA yet, and an unlisted CPE would read as a match that does not exist. wolfPSA had no machine-readable version, only the CHANGELOG heading and README text. Add wolfpsa/wolfpsa_version.h with LIBWOLFPSA_VERSION_STRING and LIBWOLFPSA_VERSION_HEX in the same form as wolfSSL's version.h, with the decimal digits in place (5.10.12 is 0x05010012). It is also the version source the SBOM tooling's --version-file/--version-macro needs. The name is not version.h because the Zephyr module puts wolfpsa/ first on the global include path, where it would shadow the <version.h> that wolfSSL's settings.h and wc_port.h fall back to. Add a Version Check workflow running .github/scripts/check-version.sh. It fails when the HEX value, the first CHANGELOG heading (skipping an "Unreleased" section), the module.yml PURL or the README's "wolfPSA vX.Y.Z" disagree with the header, and on a tag push whose name is not vX.Y.Z. The wolfSSL -stable pins are not checked, since CI moves to a new wolfSSL release before the matching wolfPSA release.
Frauschi
force-pushed
the
zephyr-module-security-refs
branch
from
October 21, 2026 07:41
c21f0ef to
8a4cb1f
Compare
Member
Author
|
The failing CI test is addressed in #36. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
west spdxonly lists a module's identifiers fromsecurity: external-referencesinzephyr/module.yml. wolfPSA had none, so SBOMs gave scanners nothing to match against.zephyr/module.yml: addspkg:github/wolfssl/wolfpsa@v5.9.4. There's no CPE, because NVD doesn't list wolfPSA yet.wolfpsa/wolfpsa_version.h: addsLIBWOLFPSA_VERSION_STRING/_HEX, in the same form as wolfSSL'sversion.h. This is the first machine-readable wolfPSA version, and the SBOM tooling can read it. It isn't namedversion.hbecause Zephyr putswolfpsa/first on the include path, where it would shadow<version.h>.-stableCI pins aren't checked, because CI moves to a new wolfSSL release before the matching wolfPSA release.Tested: the check passes on this branch, and fails on stale, suffixed or commented-out versions in scratch copies.