[sameehj]

Summary

• wolfssl_compliance_tooling_add_sbom() creates install-sbom and uninstall-sbom. The install copies the CycloneDX and SPDX files the caller set. DESTDIR is applied when the target runs.
• The helper uses the renamed script directory. Git supplies a commit time only when the source tree is the repository toplevel.
• The driver version is --version=<value>, so CMake before 3.24 does not treat it as its own flag. The toplevel check uses get_filename_component(... REALPATH), which CMake 3.16 provides.
• A second call in the same tree sets INSTALL_TARGET and UNINSTALL_TARGET.
• DEP_LIBZ and DOCUMENT_NAMESPACE stay in sbom: record a traced library, zlib, and explicit dependency versions #37.

Implements #34.

Test plan

• python3 tests/test_sbom_cmake_install.py
• python3 -m unittest tests.test_low_findings
• After the vendor sync, wolfBoot cmake --build build --target install-sbom installs the config-tag files
• After the vendor sync, wolfTPM calls wolfssl_compliance_tooling_add_sbom_install(DEPENDS sbom TV ...) and installs the tag-value file

[Copilot]

🟡 Changes recommended

CMake optional-argument handling and Autotools namespace quoting break SBOM generation, and the dependency assertion can falsely pass.

3 open findings

• Quote omitted dependency options in CMake guards · New
• Pass SBOM namespace as a quoted argument · New
• Verify install-sbom's actual dependency edge · New

What changed in this PR

Adds shared CMake SBOM installation targets, aligning product integrations with the Autotools workflow.

Changes:

• Adds install/uninstall targets that preserve output filenames and honor runtime DESTDIR.
• Forwards zlib and document-namespace options and reads SOURCE_DATE_EPOCH at build time.
• Adds documentation and automated checks.

File	Description
tests/​test_sbom_cmake_install.py	Adds installation, timestamp, and target checks.
share/​sbom.am	Forwards zlib and namespace options.
share/​sbom-driver.py	Accepts and forwards new generator options.
share/​README.md	Documents CMake installation integration.
share/​build/​uninstall-sbom.cmake	Removes installed SBOM files.
share/​build/​sbom.mk	Forwards zlib and namespace options.
share/​build/​sbom.cmake	Adds installation targets and runtime timestamp wrapper.
share/​build/​sbom-with-sde.cmake	Resolves build-time reproducibility timestamps.
share/​build/​sbom-paths.cmake	Resolves shared SBOM output paths.
share/​build/​install-sbom.cmake	Installs SBOM files with staging support.
README.md	Notes the new CMake targets.
.github/​workflows/​selftest.yml	Runs the new CMake checks.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Namespace quoting breaks Autotools overrides, and implicit tag-value discovery can install stale artifacts.

4 open findings

• Quote omitted dependency options in CMake guards
• Avoid inferring stale tag-value SBOM files · New
• Verify install-sbom's actual dependency edge
• Pass SBOM namespace as a quoted argument

🧠 Review effort: Balanced

[sameehj]

@MarkAtwood the four review findings stay fixed, and this branch now includes current master.

• The five CMake guards compare the quoted expansion, so an omitted keyword stays omitted and an explicit no is still forwarded.
• --document-namespace is its own quoted argument. It is not stored inside dep_args.
• The install test reads CMakeFiles/Makefile2 and checks the edge CMakeFiles/install-sbom.dir/all: CMakeFiles/sbom.dir/all.
• The tag-value path stays empty unless the caller sets TV or TV_OUT. A stale .spdx sibling is not installed.

The CMake function name is wolfssl_compliance_tooling_add_sbom, matching master. tests.test_sbom_cmake_install passes. Please review.

[Frauschi]

The install and uninstall scripts look good and the DESTDIR handling matches sbom.am. One blocker: the sbom target no longer runs after the rename merge. Two smaller things below, plus an overlap with #37 that will conflict whichever lands second.

Not blocking:

• The driver path itself (_WOLFSSL_COMPLIANCE_TOOLING_DRIVER) is a normal variable set at include() time, so a call from a sibling directory gets no driver path. That predates this PR, but it now has three more users. I have a fix ready that moves both into a global property, stacked on this branch.

[MarkAtwood]

lgtm with two fixes inline, both only bite on cmake 3.16 to 3.23 so ci on 3.24+ can't see them. install and uninstall round trip clean on 3.28, with DESTDIR and with a prefix, uninstall only takes the 3 sbom files. frauschi's points all look addressed to me. a ci leg with pip install cmake==3.16.8 would have caught both. pr body and the first commit still talk about DEP_LIBZ/DOCUMENT_NAMESPACE and wolfglass_*, fix the body and squash on merge. heads up for the wolftpm sync, wolftpm-sbom-stage doesn't pin DESTDIR so DESTDIR=/pkg make install-sbom stages the lib under /pkg//_sbom_staging and generation fails, sbom.am:154 and wolfcert pin it

[sameehj]

The branch is now one commit, 20bcb13. The description uses the renamed helper and leaves DEP_LIBZ and DOCUMENT_NAMESPACE in #37.

The wolfTPM DESTDIR pin stays with the product sync. wolfCert already pins it. sbom.am in this repository is unchanged.

[Frauschi]

@sameehj Please fix conflicts, otherwise LGTM. This now also contains my #41 Python 3.15 fixes, so I'll close #41.

[sameehj]

@Frauschi conflicts with master are resolved in 0eefff7.

• selftest.yml keeps test_sbom_cmake_install.py and adds test_sbom_autotools.py.
• sbom.cmake keeps the install targets and the quoted dependency guards. It also takes DEP_LIBZ, DOCUMENT_NAMESPACE, and the user-settings options from master.
• DEP_LIBZ uses the quoted guard, so an explicit no is still forwarded.

The earlier points stay fixed on this commit: --version=${SB_VERSION}, get_filename_component(... REALPATH), and INSTALL_TARGET.