WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

sbom: name each document after the configuration it describes 

Both output files were wolfboot-<version>.{cdx,spdx}.json, so every
configuration at a given version wrote to the same two paths. wolfBoot has
on the order of 100 target configurations and each is a different image
with a different source set, so building a second one overwrote the first
with no warning.

Put TARGET, SIGN and HASH in the name, on the Make and the CMake route
alike, so the two routes stay in step.

This does not fix the identity of the documents themselves. gen-sbom
derives both the CycloneDX serialNumber and the SPDX documentNamespace
from name and version only, so sim and stm32h7 at 2.9.0 still share
urn:uuid:6dc51759-ade2-5967-b392-2f23ed0eb4df, which a tool that keys on
serialNumber treats as one project. That is a wolfGlass change, and it
is not worked around here.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
pull/824/head
Sameeh Jubran 2026-08-13 10:11:30 +03:00 committed by Daniele Lacamera
parent 1a067c23fb
commit 433c6ae85c
4 changed files with 37 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Makefile
View File

@ -934,8 +934,15 @@ SBOM_COMPONENT_TYPE?=firmware
# Every GPL-headered source says "either version 3 ... or (at your option) any
# later version".
SBOM_LICENSE_OVERRIDE?=GPL-3.0-or-later
SBOM_CDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).cdx.json
SBOM_SPDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).spdx.json
# One version of wolfBoot has about 100 configurations, and each one is a
# different image with a different source set. Name the document after the
# configuration so a second target does not overwrite the first. gen-sbom still
# derives serialNumber and the SPDX documentNamespace from name and version
# alone, which collides inside a scanner as well; that part is wolfGlass's to
# fix, and this does not paper over it.
SBOM_CONFIG_TAG:=$(TARGET)$(if $(SIGN),-$(SIGN))$(if $(HASH),-$(HASH))
SBOM_CDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).cdx.json
SBOM_SPDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).spdx.json
SBOM_GEN?=
# Guards both SBOM targets: see SBOM_SRCS_MISSING above. SBOM_ALLOW_MISSING=1

6
README.md
View File

@ -160,8 +160,10 @@ an identical CycloneDX 1.6 / SPDX 2.3 document however you build:
| Zephyr TEE/PSA module | `tools/scripts/ide-sbom/zephyr_sbom.py` |
Output files are written to the build directory as
`wolfboot-<version>.cdx.json` (CycloneDX 1.6) and `wolfboot-<version>.spdx.json`
(SPDX 2.3 JSON), where `<version>` is read from `include/wolfboot/version.h`.
`wolfboot-<target>-<sign>-<hash>-<version>.cdx.json` (CycloneDX 1.6) and
`wolfboot-<target>-<sign>-<hash>-<version>.spdx.json` (SPDX 2.3 JSON), where
`<version>` is read from `include/wolfboot/version.h`. Each configuration is a
different image, so each one gets its own document.
See [docs/SBOM.md](./docs/SBOM.md) for the full per-build-system guide. For CRA
guidance and worked SBOM examples, see the

19
cmake/sbom.cmake
View File

@ -60,6 +60,21 @@ if(NOT DEFINED SBOM_WOLFSSL_VERSION OR SBOM_WOLFSSL_VERSION STREQUAL "")
endif()
endif()
# Mirrors SBOM_CONFIG_TAG in the Makefile: one version of wolfBoot covers about
# 100 configurations, and each is a different image, so the document is named
# after the configuration rather than the version alone.
if(DEFINED WOLFBOOT_TARGET AND NOT WOLFBOOT_TARGET STREQUAL "")
set(_sbom_config_tag "${WOLFBOOT_TARGET}")
else()
set(_sbom_config_tag "notarget")
endif()
if(SIGN)
string(APPEND _sbom_config_tag "-${SIGN}")
endif()
if(HASH)
string(APPEND _sbom_config_tag "-${HASH}")
endif()
set(_sbom_args
NAME wolfboot
VERSION_FILE ${WOLFBOOT_ROOT}/include/wolfboot/version.h
@ -79,8 +94,8 @@ set(_sbom_args
LICENSE_OVERRIDE GPL-3.0-or-later
DEP_WOLFSSL ${SBOM_DEP_WOLFSSL}
DEP_WOLFCRYPT ${SBOM_DEP_WOLFCRYPT}
CDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.cdx.json
SPDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.spdx.json
CDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.cdx.json
SPDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.spdx.json
)
if(SBOM_WOLFSSL_VERSION AND NOT SBOM_WOLFSSL_VERSION STREQUAL "")

11
docs/SBOM.md
View File

@ -337,11 +337,14 @@ python3 tools/sbom/frontends/compdb_sbom.py build/compile_commands.json \
Every route writes, into the working/build directory:
* `wolfboot-<version>.cdx.json` — CycloneDX 1.6
* `wolfboot-<version>.spdx.json` — SPDX 2.3
* `wolfboot-<target>-<sign>-<hash>-<version>.cdx.json` — CycloneDX 1.6
* `wolfboot-<target>-<sign>-<hash>-<version>.spdx.json` — SPDX 2.3
`<version>` is read from `include/wolfboot/version.h`. These are ignored by
`.gitignore`.
`<version>` is read from `include/wolfboot/version.h`. `<target>`, `<sign>`, and
`<hash>` are the configuration you built. One version of wolfBoot covers about
100 configurations, and each one is a different image with a different source
set, so the configuration is part of the name. Without it, a second target
overwrites the first. These files are ignored by `.gitignore`.
You can sanity-check any output: