From 5093992973ffcb333d5f5c70c69e8040a2db12b8 Mon Sep 17 00:00:00 2001 From: Sameeh Jubran Date: Wed, 12 Aug 2026 10:36:33 +0300 Subject: [PATCH] sbom: emit the registered wolfBoot CPE after NVD publication Re-vendor wolfGlass tip where PRODUCT_CPE marks wolfboot registered (NVD dictionary entries created 2026-08-10). Docs drop the "no CPE yet" wording. The main package now carries cpe:2.3:a:wolfssl:wolfboot:. Signed-off-by: Sameeh Jubran --- docs/SBOM.md | 7 ++----- tools/sbom/.wolfglass-rev | 2 +- tools/sbom/gen-sbom | 7 +++++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/SBOM.md b/docs/SBOM.md index 9231b3b6..e7385f69 100644 --- a/docs/SBOM.md +++ b/docs/SBOM.md @@ -115,11 +115,8 @@ That coat carries machine-resolvable identifiers for both scanner families: provenance rather than driving matches. * `pkg:github/wolfssl/wolfssl@v-stable` — resolvable PURL for the wolfssl release (lowercase per purl-spec; `-stable` is the real tag). -* wolfBoot itself carries **no CPE**: NVD does not list the product, and an - unlisted CPE is indistinguishable to a scanner from a listed one with no - advisories. The submitted identifier is recorded as - `wolfssl:sbom:cpe-requested` with `wolfssl:sbom:cpe-status=pending` until the - dictionary entry is published (see wolfGlass `docs/cpe-requests/wolfboot.md`). +* wolfBoot itself: `cpe:2.3:a:wolfssl:wolfboot::*:*:*:*:*:*:*` — + registered in the NVD Official CPE Dictionary (published 2026-08-10). ### Only wolfCrypt is compiled in diff --git a/tools/sbom/.wolfglass-rev b/tools/sbom/.wolfglass-rev index 53205bd7..c0f21c59 100644 --- a/tools/sbom/.wolfglass-rev +++ b/tools/sbom/.wolfglass-rev @@ -1 +1 @@ -d917c355669a0c8b9408b46355890b734ed54ae4 +1bfcf4f1a293ba09f0ff6d67904dca09ee8eb6d7 diff --git a/tools/sbom/gen-sbom b/tools/sbom/gen-sbom index 31e99a0c..05a5e3c1 100755 --- a/tools/sbom/gen-sbom +++ b/tools/sbom/gen-sbom @@ -25,6 +25,9 @@ from datetime import datetime, timezone # shapes because dropping --dep-liboqs did not bump it, leaving vendored # copies indistinguishable by the only identifier the SBOM records. # +# 1.7 wolfBoot CPE is registered in the NVD Official CPE Dictionary +# (published 2026-08-10). PRODUCT_CPE status flips to registered so +# the main package emits `cpe` and the pending properties stop. # 1.6 A product whose CPE is only pending at NVD no longer emits a `cpe` # field; the intended identifier moves to # `wolfssl:sbom:cpe-requested` alongside @@ -47,7 +50,7 @@ from datetime import datetime, timezone # -only/-or-later distinction cannot be inferred. # 1.2 Dropped --dep-liboqs (unversioned; see above). GEN_SBOM_TOOL_NAME = 'wolfssl-sbom-gen' -GEN_SBOM_VERSION = '1.6' +GEN_SBOM_VERSION = '1.7' # Placeholder recorded in the component checksum fields when the operator # passes --no-artifact-hash: a build (ROM image, HSM firmware, binary-only @@ -157,7 +160,7 @@ PRODUCT_CPE = { 'wolfcrypt': {'vendor': 'wolfssl', 'product': 'wolfcrypt', 'status': 'registered'}, 'wolfmqtt': {'vendor': 'wolfssl', 'product': 'wolfmqtt', 'status': 'registered'}, 'wolfssh': {'vendor': 'wolfssh', 'product': 'wolfssh', 'status': 'registered'}, - 'wolfboot': {'vendor': 'wolfssl', 'product': 'wolfboot', 'status': 'pending'}, + 'wolfboot': {'vendor': 'wolfssl', 'product': 'wolfboot', 'status': 'registered'}, }