From 433c6ae85ce57129d178bfea4831f2c2a32fac1c Mon Sep 17 00:00:00 2001 From: Sameeh Jubran Date: Thu, 13 Aug 2026 10:11:30 +0300 Subject: [PATCH] sbom: name each document after the configuration it describes Both output files were wolfboot-.{cdx,spdx}.json, so every configuration at a given version wrote to the same two paths. wolfBoot has on the order of 100 target configurations and each is a different image with a different source set, so building a second one overwrote the first with no warning. Put TARGET, SIGN and HASH in the name, on the Make and the CMake route alike, so the two routes stay in step. This does not fix the identity of the documents themselves. gen-sbom derives both the CycloneDX serialNumber and the SPDX documentNamespace from name and version only, so sim and stm32h7 at 2.9.0 still share urn:uuid:6dc51759-ade2-5967-b392-2f23ed0eb4df, which a tool that keys on serialNumber treats as one project. That is a wolfGlass change, and it is not worked around here. Signed-off-by: Sameeh Jubran --- Makefile | 11 +++++++++-- README.md | 6 ++++-- cmake/sbom.cmake | 19 +++++++++++++++++-- docs/SBOM.md | 11 +++++++---- 4 files changed, 37 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index 0a47a798..f5d5e545 100644 --- a/Makefile +++ b/Makefile @@ -934,8 +934,15 @@ SBOM_COMPONENT_TYPE?=firmware # Every GPL-headered source says "either version 3 ... or (at your option) any # later version". SBOM_LICENSE_OVERRIDE?=GPL-3.0-or-later -SBOM_CDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).cdx.json -SBOM_SPDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).spdx.json +# One version of wolfBoot has about 100 configurations, and each one is a +# different image with a different source set. Name the document after the +# configuration so a second target does not overwrite the first. gen-sbom still +# derives serialNumber and the SPDX documentNamespace from name and version +# alone, which collides inside a scanner as well; that part is wolfGlass's to +# fix, and this does not paper over it. +SBOM_CONFIG_TAG:=$(TARGET)$(if $(SIGN),-$(SIGN))$(if $(HASH),-$(HASH)) +SBOM_CDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).cdx.json +SBOM_SPDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).spdx.json SBOM_GEN?= # Guards both SBOM targets: see SBOM_SRCS_MISSING above. SBOM_ALLOW_MISSING=1 diff --git a/README.md b/README.md index 84938197..27a8db95 100644 --- a/README.md +++ b/README.md @@ -160,8 +160,10 @@ an identical CycloneDX 1.6 / SPDX 2.3 document however you build: | Zephyr TEE/PSA module | `tools/scripts/ide-sbom/zephyr_sbom.py` | Output files are written to the build directory as -`wolfboot-.cdx.json` (CycloneDX 1.6) and `wolfboot-.spdx.json` -(SPDX 2.3 JSON), where `` is read from `include/wolfboot/version.h`. +`wolfboot----.cdx.json` (CycloneDX 1.6) and +`wolfboot----.spdx.json` (SPDX 2.3 JSON), where +`` is read from `include/wolfboot/version.h`. Each configuration is a +different image, so each one gets its own document. See [docs/SBOM.md](./docs/SBOM.md) for the full per-build-system guide. For CRA guidance and worked SBOM examples, see the diff --git a/cmake/sbom.cmake b/cmake/sbom.cmake index db70c6b5..a89519eb 100644 --- a/cmake/sbom.cmake +++ b/cmake/sbom.cmake @@ -60,6 +60,21 @@ if(NOT DEFINED SBOM_WOLFSSL_VERSION OR SBOM_WOLFSSL_VERSION STREQUAL "") endif() endif() +# Mirrors SBOM_CONFIG_TAG in the Makefile: one version of wolfBoot covers about +# 100 configurations, and each is a different image, so the document is named +# after the configuration rather than the version alone. +if(DEFINED WOLFBOOT_TARGET AND NOT WOLFBOOT_TARGET STREQUAL "") + set(_sbom_config_tag "${WOLFBOOT_TARGET}") +else() + set(_sbom_config_tag "notarget") +endif() +if(SIGN) + string(APPEND _sbom_config_tag "-${SIGN}") +endif() +if(HASH) + string(APPEND _sbom_config_tag "-${HASH}") +endif() + set(_sbom_args NAME wolfboot VERSION_FILE ${WOLFBOOT_ROOT}/include/wolfboot/version.h @@ -79,8 +94,8 @@ set(_sbom_args LICENSE_OVERRIDE GPL-3.0-or-later DEP_WOLFSSL ${SBOM_DEP_WOLFSSL} DEP_WOLFCRYPT ${SBOM_DEP_WOLFCRYPT} - CDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.cdx.json - SPDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.spdx.json + CDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.cdx.json + SPDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.spdx.json ) if(SBOM_WOLFSSL_VERSION AND NOT SBOM_WOLFSSL_VERSION STREQUAL "") diff --git a/docs/SBOM.md b/docs/SBOM.md index 02b79e7d..95c6fd9e 100644 --- a/docs/SBOM.md +++ b/docs/SBOM.md @@ -337,11 +337,14 @@ python3 tools/sbom/frontends/compdb_sbom.py build/compile_commands.json \ Every route writes, into the working/build directory: -* `wolfboot-.cdx.json` — CycloneDX 1.6 -* `wolfboot-.spdx.json` — SPDX 2.3 +* `wolfboot----.cdx.json` — CycloneDX 1.6 +* `wolfboot----.spdx.json` — SPDX 2.3 -`` is read from `include/wolfboot/version.h`. These are ignored by -`.gitignore`. +`` is read from `include/wolfboot/version.h`. ``, ``, and +`` are the configuration you built. One version of wolfBoot covers about +100 configurations, and each one is a different image with a different source +set, so the configuration is part of the name. Without it, a second target +overwrites the first. These files are ignored by `.gitignore`. You can sanity-check any output: