mirror of https://github.com/wolfSSL/wolfBoot.git
a4ef6c4618
The bootloader is built WOLFCRYPT_ONLY: include/user_settings.h defines it for every configuration except a wolfHSM server with certificate-chain verification, so the image carries the crypto subset of wolfSSL and no TLS. The SBOM said nothing about that, leaving an integrator to triage TLS advisories against a bootloader that cannot run TLS. The re-vendored generator reads the macro out of the captured configuration and records the subset; the wolfssl component stays, because it is the identifier NVD maps wolfSSL advisories to and the wolfcrypt one has no CVEs mapped to it at all. wolfcrypt is now nested inside wolfssl rather than beside it, which is where it ships from. wolfBoot also stopped emitting a CPE. NVD has no wolfssl:wolfboot entry, and an unlisted CPE is indistinguishable to a scanner from a listed one with no advisories; the submitted identifier is recorded as wolfssl:sbom:cpe-requested until the dictionary request is published. The CMake route passed its -D set with no settings header, so it recorded none of the configuration user_settings.h derives from that set -- a different document than `make sbom` produced from the same tree, and one that could not see WOLFCRYPT_ONLY. It now passes the same SETTINGS_H and INCLUDE_DIRS the Makefile does. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com> |
||
|---|---|---|
| .. | ||
| sbom.cmake | ||
| sbom.mk | ||