Repository navigation
Conversation
Overlay share/ onto wolfBoot and wolfTPM and generate each SBOM. Keep the old Make macro name so the current wolfBoot Makefile still parses.
There was a problem hiding this comment.
🟡 Changes recommended
The wolfTPM canary omits the required spdx-tools dependency and fails before validation.
1 open issue
What changed in this PR
Adds CI canaries to check shared SBOM tooling against temporary wolfBoot and wolfTPM checkouts without updating their pinned copies.
Changes:
- Generate, validate, scan for host paths, and upload product SBOMs.
- Preserve compatibility with the legacy Make macro name.
| File | Description |
|---|---|
| share/build/sbom.mk | Adds the legacy wolfglass_sbom_rule alias. |
| .github/workflows/sbom-canary.yml | Adds wolfBoot and wolfTPM SBOM canary jobs. |
Review effort: Balanced
The autotools fragment stops when pyspdxtools is absent.
configure records PYSPDXTOOLS. A later install leaves that variable empty.
SourceFileLoader.load_module is gone in Python 3.15, so the low-findings self-test exited before it ran. Use exec_module, and pass maxsplit to re.split by name. This is the same fix that landed with #36.
Frauschi
left a comment
Frauschi
left a comment
There was a problem hiding this comment.
Both canary jobs look right in the logs, and the Make alias expands identically on GNU Make 3.81 and 4.4. One gap: the CMake helper has the same rename problem (inline).
History: da30e72 is already on master via #36, so a rebase drops it. Please also squash 92da754 and 8ef25b9 into the first commit.
| # Products vendored before the rename still call wolfglass_sbom_rule. | ||
| # Keep that name so a sync does not break their Makefile. | ||
| # Use a recursive reference, not $(value): $(call) must expand $(1) and $(2). | ||
| wolfglass_sbom_rule = $(wolfssl_compliance_tooling_sbom_rule) |
There was a problem hiding this comment.
The CMake helper needs the same alias. wolfBoot cmake/sbom.cmake:116 and wolfTPM CMakeLists.txt:1156 call wolfglass_add_sbom(), which build/sbom.cmake no longer defines. With wolfTPM's arguments against this branch, configure fails with Unknown CMake command "wolfglass_add_sbom". This fixes it:
macro(wolfglass_add_sbom)
wolfssl_compliance_tooling_add_sbom(${ARGN})
endmacro()The canary misses it because neither job builds through CMake. A CMake step in the wolfTPM job would cover it.
Line 197 restates line 196 and can go.
| run: | | ||
| python3 tooling/tools/wolfssl-compliance-tooling-sync \ | ||
| --src tooling \ | ||
| --dest product |
There was a problem hiding this comment.
Please pass --prune. Without it, a file removed from share/ stays in the product, which hides the break this job should catch.
| # repositories keep their pinned copy. This job does not push to them. | ||
| # | ||
| # wolfBoot is the plain-Make product. wolfTPM is the autotools product. | ||
| # Add a product here only after it vendors tools/sbom/. |
There was a problem hiding this comment.
Worth a line here that both products build from their default branch, so a break there fails our share/ PRs.
Summary
share/, CI copies that copy into a temporary wolfBoot checkout and a temporary wolfTPM checkout.wolfglass_sbom_rulestill works, so the current wolfBoot Makefile parses after the copy.Test plan
validate_sbom.pypasses.validate_sbom.pypasses.