[MarkAtwood]

adds make sbom, make install-sbom, make uninstall-sbom to wolfEngine's autotools build, CycloneDX 1.6 + SPDX 2.3, for CRA.

the recipe and gen-sbom are vendored from wolfssl-compliance-tooling into tools/sbom/ with its sync tool, pinned at 7335675 (tools/sbom/.wolfssl-compliance-tooling-rev). no wolfssl checkout needed anymore, WOLFSSL_DIR is optional and only used for the wolfssl dep version.

make sbom
make install-sbom    # $(docdir), honors DESTDIR
make uninstall-sbom

tested against wolfssl master and openssl 1.1.1w. sbom hash matches sha256sum of the installed libwolfengine.so.1, WE_* build macros match cc -dM -E with AM_CFLAGS + include/config.h, two runs byte-identical, make dist ships tools/sbom and make sbom works from the tarball, make test clean. build properties are identical to the old scripts/sbom.am version, only change is lowercase purls and the wolfssl dep purl is now @v5.9.4-stable to match the real tags.

dropped the github sbom workflow, it never ran here and can't build on ubuntu-latest since that's openssl 3. re-pin after wolfSSL/wolfssl-compliance-tooling#37 lands.

[Copilot]

Pull request overview

Adds SBOM generation + install/uninstall targets to the autotools build to produce CycloneDX 1.6 and SPDX 2.3 outputs (via wolfSSL’s scripts/gen-sbom), and wires tool detection into configure.ac.

Changes:

• Adds make sbom, make install-sbom, and make uninstall-sbom targets (plus uninstall hook integration).
• Introduces configure-time detection for SBOM-related tools (python3, pyspdxtools).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Makefile.am	Adds SBOM build/install/uninstall targets and staging logic for SBOM generation artifacts.
configure.ac	Adds AC_CHECK_PROG checks for SBOM-related tools.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rlm2002]

Skoll Code Review

Scan type: reviewOverall recommendation: REQUEST_CHANGES
Findings: 5 total — 3 posted, 2 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] SBOM build-options capture omits AM_CFLAGS, where all wolfEngine feature macros live — scripts/sbom.am:131-133
• [Medium] config.h fallback path never matches wolfEngine's include/config.h — scripts/sbom.am:132
• [Low] PR trigger 'branches: [*]' does not match slashed base branches — .github/workflows/sbom.yml:8-9

Skipped findings

• [Low] SBOM 'records the configured build options' claim is inaccurate as implemented
• [Info] install-sbom is opt-in but uninstall-sbom is hooked into uninstall (minor asymmetry)

Review generated by Skoll

[MarkAtwood]

@JacobBarthelmeh approved by jack back in august, green, can you merge?

[sameehj]

@MarkAtwood Isn't it better to migrate to wolfssl-compliance-tooling before merging??

[MarkAtwood]

yeah, agreed. toolkit master's sbom.am already has the AM_CFLAGS capture rlm2002 asked for here, so nothing gets lost. i'll re-vendor tools/sbom from compliance-tooling and drop scripts/sbom.am, pinned to master for now, re-pin after wolfSSL/wolfssl-compliance-tooling#37 lands

[MarkAtwood]

@jackctj117 reworked per sameeh's ask, the sbom bits are vendored from wolfssl-compliance-tooling now instead of a copied scripts/sbom.am. same targets, same sbom content except lowercase purls, and the gh workflow is gone. ptal