The generator now ships in tools/sbom, so the autotools and CMake
targets no longer need a wolfSSL checkout to find it. WOLFSSL_DIR
remains only for the wolfSSL dependency version.
The vendored fragment had drifted 23 lines behind wolfSSL's canonical
scripts/sbom.am. The copy here predated three upstream fixes:
- SBOM_CONFIG_H, which lets a product whose AC_CONFIG_HEADERS lives in
a subdirectory point the macro capture at the right config.h.
- sbomdir now uses Automake's $(docdir), so a --docdir override is
honoured instead of being hardcoded to $(datadir)/doc/$(PACKAGE).
- The macro capture now also passes $(AM_CFLAGS) $(CFLAGS), because
some products carry their feature -D flags there rather than in
AM_CPPFLAGS.
This drift shipped: it reached master when #536 merged. Drift like this
is exactly what a shared fragment is meant to prevent, and it is
invisible in review because each copy looks self-consistent on its own.
Replace the file wholesale so it is byte-identical to wolfssl master,
which also makes it byte-identical to the wolfCLU, wolfEngine, wolfMQTT,
wolfProvider, wolfSCEP and wolfSSH copies.
wolfTPM sets SBOM_OPTIONS_H, so it takes the product options-header path
and does not need an SBOM_CONFIG_H override of its own.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Autotools: replace the inline make sbom recipe with the shared
scripts/sbom.am fragment (declare wolftpm identity, LICENSE, wolfSSL
dependency, and wolftpm/options.h as the feature-macro source). Add GIT
discovery + AC_SUBST for reproducible SOURCE_DATE_EPOCH, and revert the
WOLFTPM_LIBRARY_VERSION_{FIRST,SECOND,THIRD} split that only fed the old
hardcoded --lib path (the fragment discovers the artifact by glob).
CMake: pin the SBOM licence to GPL-3.0-or-later (header-accurate; matches
autotools SBOM_LICENSE_OVERRIDE) and record wolfSSL as a dependency via
--dep-wolfssl, capability-gated on gen-sbom --help so older gen-sbom
versions still produce a valid (dependency-less) SBOM.
Pin the license default to GPL-3.0-or-later to match the source headers
("or (at your option) any later version"), fixing the SBOM licence field.
Add a CI workflow that builds wolfSSL + wolfTPM and asserts SBOM identity,
licence, options capture, reproducibility, and the wolfSSL dependency.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Use unshare --user --net to isolate fwtpm_check.sh TCP ports in CI, eliminating flaky port conflicts on shared runners. Add macOS CI with socket transport tests. Add Windows socket portability (Winsock2) and build-only CI via CMake.
Add portable firmware TPM 2.0 implementation (fwTPM) built on wolfCrypt.
Implements 105/113 TPM 2.0 v1.38 commands (93%) as a standalone server
with socket and TIS transports, NV storage, and full CI/fuzz coverage.
- src/tpm2_wrap.c: wolfTPM2_Init auto-SPDM path now calls vendor-specific
wolfTPM2_SpdmConnectNuvoton/Nations (which sets TIS I/O, mode, and the
host ephemeral key pair for mutual auth). Previous refactor to the
generic wolfTPM2_SpdmConnect dropped that setup, so FINISH failed with
WOLFSPDM_E_PEER_ERROR whenever the TPM was in SPDM-only-locked mode.
- src/tpm2_spdm.c: wolfSPDM_ParseVendorDefined returns payload dataLen
(>=0) on success per spdm_tcg.c:72 convention. wolfTPM2_SPDM_SecuredExchange
was treating any non-zero return as an error, so the first TPM command
over SPDM (10-byte Startup response) bubbled up as rc=0xa.
- tests/unit_tests.c: Add test_tpm_alg_supported() helper that queries
TPM_CAP_ALGS and skip test_wolfTPM2_EccSignVerifyDig iterations when the
hash isn't supported. Nuvoton NPCT75x lacks SHA512 and returns
TPM_RC_SIZE parameter 1 (not TPM_RC_HASH), so the prior post-hoc skip
couldn't catch it.
- .github/workflows/hw-spdm-test.yml: New workflow targeting a self-hosted
Raspberry Pi runner. Runs examples/spdm/spdm_test.sh against real Nuvoton
hardware. Fork-PR gated. Health check soft-fails with a warning if the
Pi is unhealthy so merging isn't blocked on a flaky runner. Nations
matrix entry scaffolded (commented) for when the NS350 is wired.
- scripts/hw-runner-health-check.sh: Pre-flight that verifies /dev/spidev,
/dev/gpiochip, and gpiod are present+accessible before the build.
David Garske
Aidan Garske
Sameeh Jubran
aidan garske
Elms