sbom: vendor wolfssl-compliance-tooling for make and CMake by sameehj · Pull Request #11701 · wolfSSL/wolfssl

sameehj · 2026-10-09T14:22:27Z

Summary

Vendor the pinned wolfssl-compliance-tooling snapshot at tools/sbom/. scripts/gen-sbom forwards to tools/sbom/gen-sbom. scripts/sbom.am includes tools/sbom/sbom.am.
make sbom and the CMake sbom target use that snapshot. make bomsh still passes SBOM_LIB_OVERRIDE so the traced library is the hashed file. make advisory is unchanged.
The Linux SBOM job accepts pkg:github/wolfssl/wolfssl@v<version>-stable. .gitignore no longer drops tools/sbom/build/.
The pin is 27f7a314d9b54c6902391897940d7ef181ee2d84, the tip of sbom: record a traced library, zlib, and explicit dependency versions wolfssl-compliance-tooling#37. Merge this pull request after that one.

Test plan

python3 -m unittest scripts/test_gen_sbom.py
./configure --enable-shared --enable-static && make sbom
Confirm ntia-checker -c ntia wolfssl-*.spdx.json is conformant and the CycloneDX 1.6 strict validator accepts wolfssl-*.cdx.json.
Confirm the SPDX package URL is pkg:github/wolfssl/wolfssl@v<version>-stable.
Configure with CMake and confirm tools/sbom/build/sbom.cmake is present in the clone.

github-actions · 2026-10-09T14:26:16Z

Copilot

🟡 Changes recommended

Driver contract mismatches and CMake portability and embedding defects currently break supported SBOM routes.

5 open findings

CMake SBOM target cannot launch POSIX wrapper on Windows · New
SBOM license metadata uses consuming project paths · New
Driver incorrectly combines no-hash mode with a hash source · New
SBOM user settings route bypasses effective settings.h configuration · New
Generator discovery references nonexistent share/gen-sbom path · New

What changed in this PR

Vendors pinned SBOM tooling and routes wolfSSL’s Autotools, CMake, and standalone generation through it.

Changes:

Adds the pinned generator, drivers, validators, and build-system frontends.
Rewires make sbom, CMake, packaging, and legacy entry points.
Updates tests, CI, documentation, and wolfSSL PURLs.

File	Description
`.gitignore`	Tracks vendored SBOM build helpers.
`.github/workflows/sbom.yml`	Updates syntax and PURL checks.
`CMakeLists.txt`	Adds the CMake SBOM target.
`Makefile.am`	Uses and packages vendored tooling.
`doc/CRA.md`	Documents new paths and PURL.
`doc/SBOM.md`	Documents vendored generation flow.
`scripts/gen-sbom`	Forwards to the vendored generator.
`scripts/include.am`	Packages compatibility entry points.
`scripts/sbom.am`	Includes the vendored recipe.
`scripts/test_gen_sbom.py`	Tests vendored behavior and identifiers.
`tools/sbom/.wolfssl-compliance-tooling-rev`	Records the pinned revision.
`tools/sbom/README.md`	Describes the vendored toolkit.
`tools/sbom/VERSION`	Records toolkit version.
`tools/sbom/build/sbom.cmake`	Provides reusable CMake integration.
`tools/sbom/build/sbom.mk`	Provides reusable Make integration.
`tools/sbom/frontends/compdb_sbom.py`	Adds compilation-database extraction.
`tools/sbom/frontends/iar_sbom.py`	Adds IAR project extraction.
`tools/sbom/frontends/zephyr_sbom.py`	Adds Zephyr source extraction.
`tools/sbom/gen-sbom`	Implements SBOM generation.
`tools/sbom/sbom-driver`	Adds the shell driver wrapper.
`tools/sbom/sbom-driver.py`	Coordinates generator inputs.
`tools/sbom/sbom.am`	Provides the shared Automake recipe.
`tools/sbom/validate_sbom.py`	Adds structural validation.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

sameehj · 2026-10-12T10:19:28Z

+    set(_cmd ${CMAKE_COMMAND} -E env HOSTCC=${SB_HOSTCC}
+             ${_WOLFSSL_COMPLIANCE_TOOLING_DRIVER}
+             --name ${SB_NAME}


The CMake helper now runs sbom-driver.py with the Python interpreter. A native Windows generator can start that file. The extensionless sbom-driver shell wrapper remains the Make and shell entry point.

The change is in wolfssl-compliance-tooling 27f7a31. This pull request pins that commit in 3d868e7bf.

sameehj · 2026-10-12T10:19:30Z

+            LICENSE ${CMAKE_SOURCE_DIR}/LICENSING
+            ROOT ${CMAKE_SOURCE_DIR}


LICENSE and ROOT now use CMAKE_CURRENT_SOURCE_DIR. An add_subdirectory() or FetchContent build reads this tree's LICENSING file. The helper already defaulted ROOT to that directory. This call was overriding it.

Fixed in 3d868e7bf.

sameehj · 2026-10-12T10:19:31Z

+        if args.lib:
+            cmd += ["--lib", args.lib]
+        if args.no_artifact_hash:
+            cmd += ["--no-artifact-hash"]


The failure was real. The driver was sending --lib and --no-artifact-hash together, and gen-sbom accepts one checksum source.

The driver now sends only --no-artifact-hash. --lib or --srcs-file still names the as-built artifact for the caller, and that path is not a second checksum source. gen-sbom is unchanged. scripts/test_gen_sbom.py and doc/SBOM.md still require the two flags together to fail.

The change is in wolfssl-compliance-tooling 27f7a31. This pull request pins that commit in 3d868e7bf.

sameehj · 2026-10-12T10:19:33Z

+        if args.user_settings:
+            if not os.path.isfile(args.user_settings):
+                sys.exit(f"ERROR: --user-settings '{args.user_settings}' "
+                         f"does not exist.")
+            cmd += ["--user-settings", args.user_settings]


--user-settings is now the path to wolfssl/wolfcrypt/settings.h. The driver also requires --user-settings-include and --user-settings-define WOLFSSL_USER_SETTINGS, and it forwards all three. A user_settings.h path alone is rejected, because that file does not carry the macros settings.h derives. Make and CMake take the same three values.

The change is in wolfssl-compliance-tooling 27f7a31. This pull request pins that commit in 3d868e7bf.

sameehj · 2026-10-12T10:19:35Z

+The shared driver is product-neutral and calls the vendored `share/gen-sbom` by
+default. Pass `--gen-sbom` only when you want to override that copy.


The README now says the driver calls the gen-sbom file in the same directory. That sentence is true in the toolkit tree and in this tree.

The change is in wolfssl-compliance-tooling 27f7a31. This pull request pins that commit in 3d868e7bf.

sameehj · 2026-10-19T03:22:04Z

@MarkAtwood the description now matches the pin in tools/sbom/.wolfssl-compliance-tooling-rev (27f7a314d9b54c6902391897940d7ef181ee2d84).

Please review this after toolkit #37 is on master.

MarkAtwood

lgtm, make sbom, make sbom from the make dist tarball and the cmake sbom target all hash the same lib sha256sum does, default autotools and cmake builds untouched, the -1798 all moved into tools/sbom/sbom.am with nothing dropped. socat is the usual flake, test 23 DUALSYSTEMFDSFLUSH has no tls in it and it's failed on 9 other prs this month. two things before merge, the target name one inline, and re-pin .wolfssl-compliance-tooling-rev to whatever wolfSSL/wolfssl-compliance-tooling#37 lands as, it's 27f7a31 and #37 head is 6536aa0 now. fyi the cdx build properties go from "1" to "" for bare #defines, nothing in wolfssl reads them, just an output change

MarkAtwood · 2026-10-20T20:26:49Z

+        set(_sbom_error "")
+    endif()
+
+    if(NOT _sbom_error STREQUAL "")


configure breaks when wolfssl gets pulled in with add_subdirectory by a project that has its own sbom target, wolftpm's -DWITH_WOLFSSL_TREE does exactly that. add_custom_target cannot create target "sbom" because another target with the same name already exists, master configures fine. PROJECT_IS_TOP_LEVEL is 3.21 so it's out, and NOT TARGET sbom doesn't help since wolftpm adds wolfssl before its own sbom. this configures under a parent with its own sbom and standalone sbom still writes both files

Suggested change

if(NOT _sbom_error STREQUAL "")

if(NOT CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)

# added as a subproject, the parent owns the sbom target name

elseif(NOT _sbom_error STREQUAL "")

Fixed in f9947fb. The sbom target is created only when CMAKE_SOURCE_DIR equals CMAKE_CURRENT_SOURCE_DIR. A parent such as wolfTPM that adds wolfSSL with add_subdirectory() keeps its own sbom target. A standalone build still creates sbom.

b94ed34 moves the tools/sbom pin to 443ef5fc53e1b80809012043890ab182c9bc6b99, current toolkit master. That includes the merge of wolfssl-compliance-tooling #37 and the later commits on master. A top-level wolfSSL build also gets install-sbom and uninstall-sbom from that snapshot. A subproject still does not create those targets.

The library SBOM now comes from the pinned tools/sbom snapshot. scripts/gen-sbom forwards to that generator, and make bomsh still passes SBOM_LIB_OVERRIDE so the traced library is the hashed file.

The Linux SBOM job now requires pkg:github/wolfssl/wolfssl@v<version>-stable. scripts/gen-sbom stays importable and forwards to tools/sbom/gen-sbom. scripts/sbom.am includes the vendored recipe so the old include path still works.

.gitignore ignored every build/ directory, so a clone omitted tools/sbom/build. CMake includes those files.

LICENSE and ROOT follow CMAKE_CURRENT_SOURCE_DIR, so an add_subdirectory build reads this project's LICENSING file. The pin moves to the driver that starts under Python, sends one checksum source, and forwards settings.h with its include path and WOLFSSL_USER_SETTINGS.

A parent that already has an sbom target, such as wolfTPM built with WITH_WOLFSSL_TREE, failed to configure. Create the target only when wolfSSL is the top project. Pin tools/sbom to 77296bc, the merge of wolfssl-compliance-tooling pull request 37.

Move tools/sbom to 443ef5fc. That commit includes the merge of toolkit wolfSSL#37 and the later install-sbom scripts. A subproject still does not create the sbom target.

WC_LINUXKM_FORCE_SVR_DYNAMIC_AUDITING and the WOLFSSL_TI_AM64X_* entries were out of order, which fails the known-macro check. The bad order also caused false "unneeded entries" reports for the entries between them.

The source-text check rejects hard tabs in tools/sbom/build/sbom.mk. The toolkit now starts each recipe line with $(SBOM_TAB) instead of a literal tab. Pin the toolkit to that revision.

Copilot AI balanced review requested due to automatic review settings October 9, 2026 14:22

Copilot started reviewing on behalf of sameehj October 9, 2026 14:23

View session

sameehj requested a review from MarkAtwood October 9, 2026 14:23

Copilot AI reviewed Oct 9, 2026

View reviewed changes

MarkAtwood previously approved these changes Oct 20, 2026

View reviewed changes

This was referenced Oct 20, 2026

sbom: record a traced library, zlib, and explicit dependency versions wolfSSL/wolfssl-compliance-tooling#37

Merged

cmake: add sbom, install-sbom, uninstall-sbom targets #10752

Closed

philljj assigned sameehj Oct 23, 2026

sameehj dismissed MarkAtwood’s stale review via f9947fb October 26, 2026 07:35

sameehj added 8 commits October 28, 2026 14:13

sbom: vendor wolfssl-compliance-tooling for make and CMake

45386ae

The library SBOM now comes from the pinned tools/sbom snapshot. scripts/gen-sbom forwards to that generator, and make bomsh still passes SBOM_LIB_OVERRIDE so the traced library is the hashed file.

sbom: track the vendored CMake and plain-Make fragments.

1d52ff3

.gitignore ignored every build/ directory, so a clone omitted tools/sbom/build. CMake includes those files.

sbom: pin the toolkit snapshot to current master

1b5a7e8

Move tools/sbom to 443ef5fc. That commit includes the merge of toolkit wolfSSL#37 and the later install-sbom scripts. A subproject still does not create the sbom target.

Sort .wolfssl_known_macro_extras in C lexical order

86cd580

WC_LINUXKM_FORCE_SVR_DYNAMIC_AUDITING and the WOLFSSL_TI_AM64X_* entries were out of order, which fails the known-macro check. The bad order also caused false "unneeded entries" reports for the entries between them.

sbom: vendor the toolkit sbom.mk without hard tabs

5bd3e93

The source-text check rejects hard tabs in tools/sbom/build/sbom.mk. The toolkit now starts each recipe line with $(SBOM_TAB) instead of a literal tab. Pin the toolkit to that revision.

sameehj force-pushed the feat/sbom-compliance-tooling branch from b94ed34 to 5bd3e93 Compare October 28, 2026 12:15

sameehj mentioned this pull request Oct 28, 2026

fix(sbom.mk): start recipe lines without a literal tab wolfSSL/wolfssl-compliance-tooling#52

Open

Navigation Menu

Repository navigation

sbom: vendor wolfssl-compliance-tooling for make and CMake - #11701

sbom: vendor wolfssl-compliance-tooling for make and CMake#11701
sameehj wants to merge 8 commits into
wolfSSL:masterfrom
sameehj:feat/sbom-compliance-tooling

sameehj commented Oct 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

sameehj Oct 12, 2026

Uh oh!

sameehj Oct 12, 2026

Uh oh!

sameehj Oct 12, 2026

Uh oh!

sameehj Oct 12, 2026

Uh oh!

sameehj Oct 12, 2026

Uh oh!

sameehj commented Oct 19, 2026

Uh oh!

MarkAtwood left a comment

Uh oh!

MarkAtwood Oct 20, 2026

Uh oh!

sameehj Oct 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		LICENSE ${CMAKE_SOURCE_DIR}/LICENSING
		ROOT ${CMAKE_SOURCE_DIR}

		The shared driver is product-neutral and calls the vendored `share/gen-sbom` by
		default. Pass `--gen-sbom` only when you want to override that copy.

-    if(NOT _sbom_error STREQUAL "")
+    if(NOT CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+        # added as a subproject, the parent owns the sbom target name
+    elseif(NOT _sbom_error STREQUAL "")

Conversation

sameehj commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

sameehj Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj commented Oct 19, 2026

Uh oh!

MarkAtwood left a comment

Choose a reason for hiding this comment

Uh oh!

MarkAtwood Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

sameehj Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sameehj commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

sameehj Oct 26, 2026 •

edited

Loading