feat: add make sbom / install-sbom / uninstall-sbom targets

Makefile.am

@@ -5,6 +5,7 @@ noinst_HEADERS =
 check_PROGRAMS =
 dist_noinst_SCRIPTS =
 DISTCLEANFILES =
+CLEANFILES =
 pkginclude_HEADERS =
 EXTRA_DIST =
 
@@ -47,3 +48,42 @@ AM_DISTCHECK_CONFIGURE_FLAGS=CPPFLAGS="-I@abs_top_srcdir@/include" --with-openss
 EXTRA_DIST += README.md \
               engine.conf \
               ChangeLog.md
+
+# SBOM generation (CRA compliance).  The recipe and the generator are the
+# vendored wolfssl-compliance-tooling snapshot in tools/sbom/ (pinned by
+# tools/sbom/.wolfssl-compliance-tooling-rev); wolfEngine just declares what it
+# is (a libwolfengine shared library that links both wolfSSL and OpenSSL) and
+# includes it.  The wolfSSL dependency version comes from pkg-config, or from a
+# wolfssl source tree with `make sbom WOLFSSL_DIR=/path/to/wolfssl`.
+SBOM_PKGNAME      = wolfengine
+SBOM_LICENSE_FILE = $(srcdir)/COPYING
+SBOM_DEP_WOLFSSL  = yes
+SBOM_DEP_OPENSSL  = yes
+
+# wolfEngine is GPLv3-or-later (per the per-file source headers: "either version
+# 3 of the License, or (at your option) any later version") or commercial.  Pin
+# the header-accurate SPDX id here so the SBOM is correct regardless of the
+# gen-sbom version's licence detection; commercial licensees can override it
+# (e.g. LicenseRef-wolfSSL-Commercial).
+SBOM_LICENSE_OVERRIDE ?= GPL-3.0-or-later
+
+# wolfEngine declares AC_CONFIG_HEADERS([include/config.h]) and carries its
+# feature macros (-DWE_HAVE_*, -DWE_NO_DYNAMIC_ENGINE, ...) in AM_CFLAGS, so
+# point the SBOM build-options capture at the real config header.
+SBOM_CONFIG_H = $(abs_builddir)/include/config.h
+
+EXTRA_DIST += tools/sbom/README.md \
+              tools/sbom/VERSION \
+              tools/sbom/.wolfssl-compliance-tooling-rev \
+              tools/sbom/gen-sbom \
+              tools/sbom/sbom-driver \
+              tools/sbom/sbom-driver.py \
+              tools/sbom/sbom.am \
+              tools/sbom/validate_sbom.py \
+              tools/sbom/build/sbom.cmake \
+              tools/sbom/build/sbom.mk \
+              tools/sbom/frontends/compdb_sbom.py \
+              tools/sbom/frontends/iar_sbom.py \
+              tools/sbom/frontends/zephyr_sbom.py
+
+include tools/sbom/sbom.am

README.md

@@ -189,6 +189,50 @@ Visual Studio.
 
 Example programs using wolfEngine can be found in the `examples/` subdirectory.
 
+## SBOM / EU CRA Compliance
+
+wolfEngine generates a Software Bill of Materials (SBOM) in CycloneDX 1.6 and
+SPDX 2.3 formats to support compliance with the EU Cyber Resilience Act (CRA).
+The SBOM records the configured build options, hashes the built `libwolfengine`
+library artifact (shared or static; ELF, Mach-O, or PE), and lists both wolfSSL
+and OpenSSL as dependencies so vulnerability scanners can associate wolfSSL and OpenSSL advisories with a
+wolfEngine deployment. Output is reproducible: set `SOURCE_DATE_EPOCH` (or
+build from a git checkout, which uses the last commit time) and repeated runs
+are byte-identical.
+
+```sh
+make sbom
+```
+
+Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). The generator
+is vendored in `tools/sbom/` from
+[wolfssl-compliance-tooling](https://github.com/wolfSSL/wolfssl-compliance-tooling)
+(revision in `tools/sbom/.wolfssl-compliance-tooling-rev`), so no wolfSSL source
+tree is needed. Pass `WOLFSSL_DIR=/path/to/wolfssl` to read the wolfSSL
+dependency version from a source tree instead of `pkg-config`.
+
+Output: `wolfengine-<version>.cdx.json`, `wolfengine-<version>.spdx.json`, `wolfengine-<version>.spdx`
+
+Optional overrides:
+
+- `SBOM_LICENSE_OVERRIDE` - SPDX expression to use instead of the licence
+  parsed from `COPYING` (e.g. `LicenseRef-wolfSSL-Commercial` for commercial
+  licensees). Defaults to `GPL-3.0-or-later` (the per-file header licence).
+- `SBOM_LICENSE_TEXT` - path to the licence text for any `LicenseRef-*` used in
+  `SBOM_LICENSE_OVERRIDE` (required by SPDX 2.3).
+- `SBOM_WOLFSSL_VERSION` - version recorded for the wolfSSL dependency;
+  auto-detected from `WOLFSSL_DIR/wolfssl/version.h` (or wolfSSL's `pkg-config`
+  entry) when unset.
+- `SBOM_OPENSSL_VERSION` - version recorded for the OpenSSL dependency;
+  resolved via OpenSSL's `pkg-config` entry when unset.
+
+```sh
+make install-sbom    # installs to $(datadir)/doc/wolfengine/
+make uninstall-sbom
+```
+
+For further CRA guidance see [wolfssl/doc/CRA.md](https://github.com/wolfSSL/wolfssl/blob/master/doc/CRA.md).
+
 ## Need Help?
 
 Please reach out to support@wolfssl.com for technical support. If you're

configure.ac

@@ -721,6 +721,16 @@ AC_SUBST([AM_CPPFLAGS])
 AC_SUBST([AM_CFLAGS])
 AC_SUBST([AM_LDFLAGS])
 
+# Tools used by the SBOM targets (see tools/sbom/sbom.am `make sbom`).  GIT is used
+# only to derive SOURCE_DATE_EPOCH for reproducible SBOM output; all three are
+# optional and the target reports a clear error when a required one is missing.
+AC_PATH_PROG([PYTHON3], [python3])
+AC_PATH_PROG([PYSPDXTOOLS], [pyspdxtools])
+AC_PATH_PROG([GIT], [git])
+AC_SUBST([PYTHON3])
+AC_SUBST([PYSPDXTOOLS])
+AC_SUBST([GIT])
+
 AC_CONFIG_FILES([Makefile
        rpm/spec])
 AC_OUTPUT

tools/sbom/.wolfssl-compliance-tooling-rev

@@ -0,0 +1 @@
+73356753159867763e4299a3520e89e13d238345

tools/sbom/README.md

@@ -0,0 +1,73 @@
+# share/
+
+This is the only vendorable set. Use `tools/wolfssl-compliance-tooling-sync` to copy these files
+into a product at `tools/sbom/`, together with the pin files (`VERSION` and
+`.wolfssl-compliance-tooling-rev`). Do not copy the `share/` folder name; copy the files.
+
+## Contents
+
+| File | Role |
+|---|---|
+| `sbom-driver.py` | The product-neutral SBOM engine (Python). |
+| `sbom-driver` | Thin shell wrapper that runs `sbom-driver.py`. |
+| `validate_sbom.py` | Structural validator for CI (`--name-prefix`). |
+| `frontends/compdb_sbom.py` | Extractor for any `compile_commands.json`. |
+| `frontends/iar_sbom.py` | Extractor for an IAR Embedded Workbench `.ewp`. |
+| `frontends/zephyr_sbom.py` | Extractor for a Zephyr module `CMakeLists.txt`. |
+| `build/sbom.mk` | Shared plain-Make fragment and `wolfssl_compliance_tooling_sbom_rule` macro. |
+| `build/sbom.cmake` | Shared CMake helper: `wolfssl_compliance_tooling_add_sbom()`. |
+| `gen-sbom` | The vendored SBOM generator. |
+| `sbom.am` | Shared autotools fragment. |
+
+## The driver contract
+
+Every front end produces a composition input and a config input and hands them to
+the driver.
+
+Composition (at least one):
+
+- `--srcs-file PATH` — the source files compiled into the artifact (tier E).
+- `--lib PATH` — the built library to hash (tier R/L/S).
+- `--no-artifact-hash` — record the artifact as-built and do not re-hash. Use it
+  with `--lib` for a FIPS canister or a kernel module. Never substitute a source
+  list for a certified artifact.
+
+Config (choose one):
+
+- `--cflags="..."` — raw CFLAGS; the driver expands the `-D` tokens through the
+  host compiler. Use the `=` form so a leading-dash value is not read as a flag.
+- `--options-h PATH` — a pre-expanded flat `#define` header, used verbatim.
+- `--user-settings PATH` — a `user_settings.h`; the generator captures it.
+- `--source-only` — no build-config macros (for example a Kconfig-driven build).
+
+Dependency (for linkers and bindings): `--dep-wolfssl`, `--dep-openssl`, and
+`--dep-version` are passed through only when the generator supports them.
+
+The driver captures macros with the host compiler, so the SBOM is reproducible
+across toolchains. It scrubs absolute host paths from the captured macros unless
+you pass `--no-scrub`.
+
+The shared driver is product-neutral and calls the vendored `share/gen-sbom` by
+default. Pass `--gen-sbom` only when you want to override that copy.
+
+## The manifest contract
+
+A product does not copy logic. It describes itself:
+
+- Make: set `SBOM_NAME`, `SBOM_SRCS`, `SBOM_CFLAGS`, and a version
+  (`SBOM_VERSION`, or `SBOM_VERSION_FILE` + `SBOM_VERSION_MACRO`), then
+  `include tools/sbom/build/sbom.mk`. For a second target, instantiate
+  `$(eval $(call wolfssl_compliance_tooling_sbom_rule,<target>,<prefix>))`.
+  If the product's configuration lives in a `user_settings.h`, also set
+  `SBOM_SETTINGS_H` (and `SBOM_INCLUDE_DIRS` if that header needs paths the
+  CFLAGS do not already carry). `SBOM_CFLAGS` alone records the literal `-D`
+  set and nothing it derives, which for a gated header means the SBOM
+  describes a configuration nobody built.
+- CMake: `include(tools/sbom/build/sbom.cmake)` and call `wolfssl_compliance_tooling_add_sbom()`
+  with `NAME`, `VERSION_FILE`, `VERSION_MACRO`, `TARGETS`, `DEFS`, `LICENSE`.
+  `SBOM_GEN` is the canonical generator override; `GEN_SBOM` remains a legacy
+  alias for compatibility.
+- Autotools: set the `SBOM_*` variables and `include tools/sbom/sbom.am`.
+
+Keep only true product knowledge in the product: the route-through script, the
+module extractor, and the HAL source selector.

tools/sbom/VERSION

@@ -0,0 +1 @@
+0.1.0-draft