wolfBoot/.github
Sameeh Jubran 1a067c23fb sbom: fail when an object maps to no source, instead of shrinking the SBOM
SBOM_SRCS runs the object list through $(wildcard), so a source that is
not on disk disappears before the driver sees it. The driver's own
--skip-missing warning then has nothing left to report, which is why it
never fires on the Make path that every embedded user takes.

The result is a document that under-reports the image with no diagnostic
anywhere. A sim-tpm build without lib/wolfTPM checked out silently loses
all eight tpm2*.c sources, and validate_sbom.py accepts the result even
though the captured configuration still records WOLFBOOT_TPM=1.

Compare the two lists instead. An object that maps to neither a .c nor a
.S on disk means a submodule or a vendor SDK is absent, so stop and name
the objects on stderr. SBOM_ALLOW_MISSING=1 accepts the partial document
for the cases where the SDK genuinely cannot be present, and still lists
what is missing; imx_rt is one, because it compiles three MCUXpresso
drivers from outside the source tree.

Every other example config either passes or names only submodule paths
that CI checks out, so no job needs the escape hatch.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
2026-08-20 15:22:16 +02:00
..
docker/renesas-rx ci: build Renesas RX example configs 2026-07-30 15:32:31 +02:00
workflows sbom: fail when an object maps to no source, instead of shrinking the SBOM 2026-08-20 15:22:16 +02:00