Repository navigation
sbom: record a traced library, zlib, and explicit dependency versions - #37
Conversation
wolfSSL make bomsh must hash the traced library, and a host without pkg-config must still record zlib and other dependency versions.
There was a problem hiding this comment.
🟡 Changes recommended
The sync migration leaves a stale legacy revision pin, and the new driver forwarding behavior lacks automated coverage.
1 open finding
What changed in this PR
Renames the toolkit and extends SBOM integrations for traced artifacts, zlib versions, and custom SPDX namespaces.
Changes:
- Renames wolfGlass identifiers, files, workflows, and documentation.
- Adds artifact override and dependency metadata support.
- Propagates new options through Autotools, Make, CMake, and the driver.
| File | Description |
|---|---|
tools/wolfssl-compliance-tooling-sync |
Renames sync tooling and revision pin. |
tools/csaf-validate/package.json |
Renames the npm package. |
tools/csaf-validate/package-lock.json |
Updates locked package identity. |
tests/test_wolfssl_compliance_tooling_sync.py |
Renames sync tests and target path. |
tests/test_sbom.py |
Updates toolkit naming. |
share/validate_sbom.py |
Updates validator branding. |
share/sbom.am |
Adds artifact, zlib, version, and namespace options. |
share/sbom-driver.py |
Forwards new generator options. |
share/sbom-driver |
Updates wrapper branding. |
share/README.md |
Documents renamed interfaces. |
share/frontends/zephyr_sbom.py |
Renames temporary files. |
share/frontends/iar_sbom.py |
Renames temporary files. |
share/frontends/compdb_sbom.py |
Renames temporary files. |
share/build/sbom.mk |
Renames macro and forwards options. |
share/build/sbom.cmake |
Renames helper and forwards options. |
README.md |
Renames toolkit documentation. |
provenance/README.md |
Renames planned provenance wrapper. |
docs/TIERS.md |
Updates toolkit terminology. |
docs/PLAN.md |
Updates project naming and planned interfaces. |
central/advisory-completeness |
Updates repository-name comment. |
ARCHITECTURE.md |
Updates architecture references. |
.github/workflows/selftest.yml |
Updates workflow names and test paths. |
.github/workflows/sbom-reusable.yml |
Renames workflow inputs and checkout paths. |
Files not reviewed (1)
- tools/csaf-validate/package-lock.json: Generated file
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
CMake starts sbom-driver.py with Python, so a native Windows generator can run the sbom target. The driver sends one checksum source, and --user-settings is settings.h plus the include path and WOLFSSL_USER_SETTINGS. Tests cover feature-detected forwarding.
sameehj
changed the title
|
@MarkAtwood the base is now master. The rename commits are not in this pull request. Please review the recipe. The branch tip is |
Frauschi
left a comment
Frauschi
left a comment
There was a problem hiding this comment.
The --no-artifact-hash fix works: the driver now sends one checksum source and the as-built mode no longer fails. The settings.h contract and its up-front check are a clear improvement. Two driver questions and a coordination point with #36 below.
Not blocking:
SBOM_LIB_OVERRIDEskips the privatemake installon purpose, which leaves the default path as the only one that hashes an installed library, and nothing tests that path end to end today. I have a small autotools fixture test for that coming separately; it doesn't need to block this PR.
The driver forwarded --lib and --srcs-file together, and the help text said those paths name the artifact under --no-artifact-hash. gen-sbom accepts one checksum source and rejects that pair, so the name never reached the document. Reject the pair in the driver, and do not require a library or a source list when the placeholder flag is set. CMake now selects the interpreter with find_package(Python3).
|
The default-path autotools test is #43. It checks that |
The install targets expanded _WOLFGLASS_SBOM_DIR, which the rename left unset, so sbom, install-sbom, and uninstall-sbom looked for a script at the filesystem root. Use the renamed directory variable, rename the new -D variables, and build the sbom target in the test. Ignore a git commit time when SBOM_ROOT is not the repository toplevel. DEP_LIBZ and DOCUMENT_NAMESPACE stay in #37.
MarkAtwood
left a comment
MarkAtwood
left a comment
There was a problem hiding this comment.
lgtm, built 5.9.4 four ways (autotools and cmake, zlib on and off) with this share/ over tools/sbom/, sbom hash matches sha256sum of the .so every time, zlib shows up exactly when ldd says it's linked, version matches pkg-config. no pkg-config and bad key cases fail the way they should. frauschi's 5 all check out. README.md:27 and the comment at sbom-driver.py:265 still say at least one, code rejects --lib with --srcs-file now, make them exactly one. wolfSSL/wolfssl#11701 vendors 27f7a31 not this head, resync it from master after this merges
Summary
SBOM_LIB_OVERRIDE, somake bomshrecords the bomtrace3 binary.SBOM_DEP_LIBZand accept explicitSBOM_DEP_VERSIONSwhen pkg-config is absent. Pass an optional SPDXSBOM_DOCUMENT_NAMESPACE.gen-sbomadvertises them.The rename is already on master in #33. This pull request is only the recipe.
Breaking change
--user-settingsis nowwolfssl/wolfcrypt/settings.h, plus--user-settings-include(the directory that containsuser_settings.h) and--user-settings-define WOLFSSL_USER_SETTINGS. A vendoredSBOM_USER_SETTINGSor CMakeUSER_SETTINGSthat still points atuser_settings.hfails. The old path recorded only the literals in that file and dropped every macrosettings.hderives.Checksum source
--liband--srcs-filetogether are rejected.--no-artifact-hashstands alone: do not pass--libor--srcs-filewith it.gen-sbomaccepts one checksum source and records a placeholder.Test plan
6536aa092057e50e834c3d601a1c9a22f38ca010. wolfSSL pull request #11701 must pin this commit.share/sbom.amforSBOM_LIB_OVERRIDE,SBOM_DEP_LIBZ,SBOM_DEP_VERSIONS, andSBOM_DOCUMENT_NAMESPACE.share/sbom-driver.py,share/build/sbom.cmake, andshare/build/sbom.mkforward the new flags only when the generator advertises them.python3 tests/test_sbom.py