WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfBoot/tools/sbom
History
Sameeh Jubran 0b6bcd1221 sbom: re-vendor wolfGlass at b44ae8d 
Picks up per-configuration serialNumber and documentNamespace, so two
configurations of one wolfBoot version no longer share an identifier
inside a scanner. Also brings CPE/PURL build-metadata stripping,
--dep-* value validation, wolfcrypt version inheritance, and the
sbom.am host-cc macro capture.

The Makefile comment that recorded this as an open wolfGlass gap is
no longer true, so it goes.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
 		2026-08-20 15:22:16 +02:00
..
build sbom: describe the wolfSSL the image really holds 2026-08-20 15:22:16 +02:00
frontends sbom: describe the wolfSSL the image really holds 2026-08-20 15:22:16 +02:00
.wolfglass-rev sbom: re-vendor wolfGlass at b44ae8d 2026-08-20 15:22:16 +02:00
README.md sbom: record the real build configuration 2026-08-20 15:22:16 +02:00
VERSION Vendor wolfGlass SBOM tooling and switch wolfBoot to it 2026-08-20 15:22:16 +02:00
gen-sbom sbom: re-vendor wolfGlass at b44ae8d 2026-08-20 15:22:16 +02:00
sbom-driver Vendor wolfGlass SBOM tooling and switch wolfBoot to it 2026-08-20 15:22:16 +02:00
sbom-driver.py sbom: describe the wolfSSL the image really holds 2026-08-20 15:22:16 +02:00
sbom.am sbom: re-vendor wolfGlass at b44ae8d 2026-08-20 15:22:16 +02:00
validate_sbom.py sbom: describe the wolfSSL the image really holds 2026-08-20 15:22:16 +02:00

README.md

share/

This is the only vendorable set. Use tools/wolfglass-sync to copy these files into a product at tools/sbom/, together with the pin files (VERSION and .wolfglass-rev). Do not copy the share/ folder name; copy the files.

Contents

File Role
sbom-driver.py The product-neutral SBOM engine (Python).
sbom-driver Thin shell wrapper that runs sbom-driver.py.
validate_sbom.py Structural validator for CI (--name-prefix).
frontends/compdb_sbom.py Extractor for any compile_commands.json.
frontends/iar_sbom.py Extractor for an IAR Embedded Workbench .ewp.
frontends/zephyr_sbom.py Extractor for a Zephyr module CMakeLists.txt.
build/sbom.mk Shared plain-Make fragment and wolfglass_sbom_rule macro.
build/sbom.cmake Shared CMake helper: wolfglass_add_sbom().
gen-sbom The vendored SBOM generator.
sbom.am Shared autotools fragment.

The driver contract

Every front end produces a composition input and a config input and hands them to the driver.

Composition (at least one):

  • --srcs-file PATH — the source files compiled into the artifact (tier E).
  • --lib PATH — the built library to hash (tier R/L/S).
  • --no-artifact-hash — record the artifact as-built and do not re-hash. Use it with --lib for a FIPS canister or a kernel module. Never substitute a source list for a certified artifact.

Config (choose one):

  • --cflags="..." — raw CFLAGS; the driver expands the -D tokens through the host compiler. Use the = form so a leading-dash value is not read as a flag.
  • --options-h PATH — a pre-expanded flat #define header, used verbatim.
  • --user-settings PATH — a user_settings.h; the generator captures it.
  • --source-only — no build-config macros (for example a Kconfig-driven build).

Dependency (for linkers and bindings): --dep-wolfssl, --dep-openssl, and --dep-version are passed through only when the generator supports them.

The driver captures macros with the host compiler, so the SBOM is reproducible across toolchains. It scrubs absolute host paths from the captured macros unless you pass --no-scrub.

The shared driver is product-neutral and calls the vendored share/gen-sbom by default. Pass --gen-sbom only when you want to override that copy.

The manifest contract

A product does not copy logic. It describes itself:

  • Make: set SBOM_NAME, SBOM_SRCS, SBOM_CFLAGS, and a version (SBOM_VERSION, or SBOM_VERSION_FILE + SBOM_VERSION_MACRO), then include tools/sbom/build/sbom.mk. For a second target, instantiate $(eval $(call wolfglass_sbom_rule,<target>,<prefix>)). If the product's configuration lives in a user_settings.h, also set SBOM_SETTINGS_H (and SBOM_INCLUDE_DIRS if that header needs paths the CFLAGS do not already carry). SBOM_CFLAGS alone records the literal -D set and nothing it derives, which for a gated header means the SBOM describes a configuration nobody built.
  • CMake: include(tools/sbom/build/sbom.cmake) and call wolfglass_add_sbom() with NAME, VERSION_FILE, VERSION_MACRO, TARGETS, DEFS, LICENSE. SBOM_GEN is the canonical generator override; GEN_SBOM remains a legacy alias for compatibility.
  • Autotools: set the SBOM_* variables and include tools/sbom/sbom.am.

Keep only true product knowledge in the product: the route-through script, the module extractor, and the HAL source selector.