mirror of https://github.com/wolfSSL/wolfBoot.git
117 lines
4.8 KiB
CMake
117 lines
4.8 KiB
CMake
# cmake/sbom.cmake - wolfBoot wrapper around the vendored wolfGlass CMake helper.
|
|
|
|
if(NOT DEFINED WOLFBOOT_ROOT)
|
|
set(WOLFBOOT_ROOT ${CMAKE_CURRENT_SOURCE_DIR})
|
|
endif()
|
|
|
|
include(${WOLFBOOT_ROOT}/tools/sbom/build/sbom.cmake)
|
|
|
|
file(STRINGS ${WOLFBOOT_ROOT}/include/wolfboot/version.h _wolfboot_ver_line
|
|
REGEX "LIBWOLFBOOT_VERSION_STRING")
|
|
string(REGEX REPLACE ".*LIBWOLFBOOT_VERSION_STRING[ \t]+\"([^\"]*)\".*"
|
|
"\\1" _wolfboot_sbom_version "${_wolfboot_ver_line}")
|
|
if(_wolfboot_sbom_version STREQUAL "")
|
|
message(FATAL_ERROR "sbom: could not read LIBWOLFBOOT_VERSION_STRING")
|
|
endif()
|
|
|
|
set(_sbom_targets wolfboot wolfboothal)
|
|
if(TARGET public_key)
|
|
list(APPEND _sbom_targets public_key)
|
|
endif()
|
|
if(DEFINED WOLFSSL_TGT AND TARGET ${WOLFSSL_TGT})
|
|
list(APPEND _sbom_targets ${WOLFSSL_TGT})
|
|
endif()
|
|
|
|
set(_sbom_defs ${WOLFBOOT_DEFS} ${WOLFBOOT_DEFS_PUBLIC} ${USER_SETTINGS} ${SIGN_OPTIONS})
|
|
|
|
# wolfBoot's wolfCrypt configuration is derived, not literal: user_settings.h
|
|
# turns WOLFBOOT_SIGN_ECC256 into HAVE_ECC and the rest, and gates
|
|
# WOLFCRYPT_ONLY. Capturing the -D set alone would record none of it, which is
|
|
# how this route used to describe a different configuration than the Makefile
|
|
# for the same bootloader. Mirrors SBOM_SETTINGS_H / SBOM_INCLUDE_DIRS there.
|
|
set(_sbom_settings_h ${WOLFBOOT_ROOT}/lib/wolfssl/wolfssl/wolfcrypt/settings.h)
|
|
set(_sbom_include_dirs ${WOLFBOOT_ROOT}/include ${WOLFBOOT_ROOT}/lib/wolfssl)
|
|
|
|
# The product description below must stay in step with the SBOM_* block of the
|
|
# Makefile. Both routes describe the same bootloader, so a customer must not
|
|
# get a different document depending on which build system they generated from.
|
|
|
|
# Coat: wolfCrypt sources stay in the source-set hash, and wolfcrypt is
|
|
# declared as a component nested inside wolfssl, which is the release it ships
|
|
# in and the only one of the pair NVD maps advisories to.
|
|
if(NOT DEFINED SBOM_DEP_WOLFSSL)
|
|
set(SBOM_DEP_WOLFSSL yes)
|
|
endif()
|
|
if(NOT DEFINED SBOM_DEP_WOLFCRYPT)
|
|
set(SBOM_DEP_WOLFCRYPT yes)
|
|
endif()
|
|
|
|
# A cross build has no pkg-config for the submodule, so the version has to come
|
|
# from the header. Without it the dependency component carries no version, and
|
|
# therefore no PURL and no CPE for a scanner to match.
|
|
if(NOT DEFINED SBOM_WOLFSSL_VERSION OR SBOM_WOLFSSL_VERSION STREQUAL "")
|
|
set(_wolfssl_ver_header ${WOLFBOOT_ROOT}/lib/wolfssl/wolfssl/version.h)
|
|
if(EXISTS ${_wolfssl_ver_header})
|
|
file(STRINGS ${_wolfssl_ver_header} _wolfssl_ver_line
|
|
REGEX "LIBWOLFSSL_VERSION_STRING")
|
|
list(GET _wolfssl_ver_line 0 _wolfssl_ver_line)
|
|
string(REGEX REPLACE ".*LIBWOLFSSL_VERSION_STRING[ \t]+\"([^\"]*)\".*"
|
|
"\\1" SBOM_WOLFSSL_VERSION "${_wolfssl_ver_line}")
|
|
endif()
|
|
endif()
|
|
|
|
# Mirrors SBOM_CONFIG_TAG in the Makefile: one version of wolfBoot covers about
|
|
# 100 configurations, and each is a different image, so the document is named
|
|
# after the configuration rather than the version alone.
|
|
if(DEFINED WOLFBOOT_TARGET AND NOT WOLFBOOT_TARGET STREQUAL "")
|
|
set(_sbom_config_tag "${WOLFBOOT_TARGET}")
|
|
else()
|
|
set(_sbom_config_tag "notarget")
|
|
endif()
|
|
if(SIGN)
|
|
string(APPEND _sbom_config_tag "-${SIGN}")
|
|
endif()
|
|
if(HASH)
|
|
string(APPEND _sbom_config_tag "-${HASH}")
|
|
endif()
|
|
|
|
set(_sbom_args
|
|
NAME wolfboot
|
|
VERSION_FILE ${WOLFBOOT_ROOT}/include/wolfboot/version.h
|
|
VERSION_MACRO LIBWOLFBOOT_VERSION_STRING
|
|
TARGETS ${_sbom_targets}
|
|
DEFS ${_sbom_defs}
|
|
SETTINGS_H ${_sbom_settings_h}
|
|
INCLUDE_DIRS ${_sbom_include_dirs}
|
|
LICENSE ${WOLFBOOT_ROOT}/LICENSE
|
|
ROOT ${WOLFBOOT_ROOT}
|
|
# wolfBoot is a bootloader flashed as an image, not a library linked into one.
|
|
COMPONENT_TYPE firmware
|
|
# LICENSE is the verbatim GPLv3, which says nothing about how wolfBoot
|
|
# licenses under it, so inference falls back to GPL-3.0-only and understates
|
|
# the grant. Every GPL-headered source says "either version 3 ... or (at your
|
|
# option) any later version".
|
|
LICENSE_OVERRIDE GPL-3.0-or-later
|
|
DEP_WOLFSSL ${SBOM_DEP_WOLFSSL}
|
|
DEP_WOLFCRYPT ${SBOM_DEP_WOLFCRYPT}
|
|
CDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.cdx.json
|
|
SPDX_OUT ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.spdx.json
|
|
)
|
|
|
|
if(SBOM_WOLFSSL_VERSION AND NOT SBOM_WOLFSSL_VERSION STREQUAL "")
|
|
list(APPEND _sbom_args DEP_VERSION
|
|
wolfssl=${SBOM_WOLFSSL_VERSION}
|
|
wolfcrypt=${SBOM_WOLFSSL_VERSION})
|
|
endif()
|
|
|
|
if(DEFINED SBOM_GEN AND NOT SBOM_GEN STREQUAL "")
|
|
list(APPEND _sbom_args SBOM_GEN ${SBOM_GEN})
|
|
elseif(DEFINED GEN_SBOM AND NOT GEN_SBOM STREQUAL "")
|
|
list(APPEND _sbom_args SBOM_GEN ${GEN_SBOM})
|
|
endif()
|
|
if(DEFINED HOSTCC AND NOT HOSTCC STREQUAL "")
|
|
list(APPEND _sbom_args HOSTCC ${HOSTCC})
|
|
endif()
|
|
|
|
wolfglass_add_sbom(${_sbom_args})
|