WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

sbom: emit the registered wolfBoot CPE after NVD publication 

Re-vendor wolfGlass tip where PRODUCT_CPE marks wolfboot registered
(NVD dictionary entries created 2026-08-10). Docs drop the "no CPE yet"
wording. The main package now carries cpe:2.3🅰️wolfssl:wolfboot:<ver>.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
pull/824/head
Sameeh Jubran 2026-08-12 10:36:33 +03:00 committed by Daniele Lacamera
parent a4ef6c4618
commit 5093992973
3 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/SBOM.md
View File

@ -115,11 +115,8 @@ That coat carries machine-resolvable identifiers for both scanner families:
provenance rather than driving matches.
* `pkg:github/wolfssl/wolfssl@v<version>-stable` — resolvable PURL for the
wolfssl release (lowercase per purl-spec; `-stable` is the real tag).
* wolfBoot itself carries **no CPE**: NVD does not list the product, and an
unlisted CPE is indistinguishable to a scanner from a listed one with no
advisories. The submitted identifier is recorded as
`wolfssl:sbom:cpe-requested` with `wolfssl:sbom:cpe-status=pending` until the
dictionary entry is published (see wolfGlass `docs/cpe-requests/wolfboot.md`).
* wolfBoot itself: `cpe:2.3:a:wolfssl:wolfboot:<version>:*:*:*:*:*:*:*` —
registered in the NVD Official CPE Dictionary (published 2026-08-10).
### Only wolfCrypt is compiled in

2
tools/sbom/.wolfglass-rev
View File

@ -1 +1 @@
d917c355669a0c8b9408b46355890b734ed54ae4
1bfcf4f1a293ba09f0ff6d67904dca09ee8eb6d7

7
tools/sbom/gen-sbom
View File

@ -25,6 +25,9 @@ from datetime import datetime, timezone
# shapes because dropping --dep-liboqs did not bump it, leaving vendored
# copies indistinguishable by the only identifier the SBOM records.
#
# 1.7 wolfBoot CPE is registered in the NVD Official CPE Dictionary
# (published 2026-08-10). PRODUCT_CPE status flips to registered so
# the main package emits `cpe` and the pending properties stop.
# 1.6 A product whose CPE is only pending at NVD no longer emits a `cpe`
# field; the intended identifier moves to
# `wolfssl:sbom:cpe-requested` alongside
@ -47,7 +50,7 @@ from datetime import datetime, timezone
# -only/-or-later distinction cannot be inferred.
# 1.2 Dropped --dep-liboqs (unversioned; see above).
GEN_SBOM_TOOL_NAME = 'wolfssl-sbom-gen'
GEN_SBOM_VERSION = '1.6'
GEN_SBOM_VERSION = '1.7'
# Placeholder recorded in the component checksum fields when the operator
# passes --no-artifact-hash: a build (ROM image, HSM firmware, binary-only
@ -157,7 +160,7 @@ PRODUCT_CPE = {
'wolfcrypt': {'vendor': 'wolfssl', 'product': 'wolfcrypt', 'status': 'registered'},
'wolfmqtt': {'vendor': 'wolfssl', 'product': 'wolfmqtt', 'status': 'registered'},
'wolfssh': {'vendor': 'wolfssh', 'product': 'wolfssh', 'status': 'registered'},
'wolfboot': {'vendor': 'wolfssl', 'product': 'wolfboot', 'status': 'pending'},
'wolfboot': {'vendor': 'wolfssl', 'product': 'wolfboot', 'status': 'registered'},
}