WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

sbom: default license to GPL-3.0-or-later and pin CI to #10343 ref 

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
pull/1201/head
Sameeh Jubran 2026-07-09 10:34:06 +03:00 committed by John Safranek
parent f0e4b404d5
commit 1f57f67db7
2 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
.github/workflows/sbom.yml vendored
View File

@ -9,7 +9,8 @@ on:
inputs:
wolfssl_ref:
description: 'wolfssl git ref that provides scripts/gen-sbom'
default: 'master'
# TODO: switch back to 'master' once wolfSSL/wolfssl#10343 merges.
default: 'refs/pull/10343/head'
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
@ -32,14 +33,16 @@ jobs:
# wolfssl is checked out once and used for two things: built + installed
# so wolfssh has a library to link, and its source tree (scripts/gen-sbom
# + wolfssl/version.h) is passed to `make sbom` via WOLFSSL_DIR. Default
# ref is master; until the wolfSSL SBOM change is on master, use the
# "Run workflow" button with wolfssl_ref set to the SBOM branch.
# + wolfssl/version.h) is passed to `make sbom` via WOLFSSL_DIR. gen-sbom
# is not yet on wolfssl master, so default to the open PR head that carries
# it (wolfSSL/wolfssl#10343) so CI actually exercises `make sbom` instead of
# silently skipping. TODO: switch the fallback back to 'master' once
# #10343 merges.
- name: Checkout wolfssl (gen-sbom + library source)
uses: actions/checkout@v4
with:
repository: wolfSSL/wolfssl
ref: ${{ github.event.inputs.wolfssl_ref || 'master' }}
ref: ${{ github.event.inputs.wolfssl_ref || 'refs/pull/10343/head' }}
path: wolfssl
- name: Install SBOM validator (pyspdxtools) and pcpp

14
Makefile.am
View File

@ -89,12 +89,12 @@ SBOM_PKGNAME = wolfssh
SBOM_LICENSE_FILE = $(srcdir)/LICENSING
SBOM_DEP_WOLFSSL = yes
# wolfSSH is GPLv3-or-commercial; its LICENSING uses the "GPLv3" abbreviation
# that older gen-sbom cannot parse (falls back to NOASSERTION). Default to the
# correct SPDX id so the SBOM is right regardless of gen-sbom version; commercial
# licensees can still override it (e.g. LicenseRef-wolfSSL-Commercial).
# Redundant-but-harmless once the detect_license fix lands in gen-sbom
# (wolfSSL/wolfssl#10343).
SBOM_LICENSE_OVERRIDE ?= GPL-3.0-only
# wolfSSH is GPLv3-or-later (per the per-file source headers: "either version 3
# of the License, or (at your option) any later version") or commercial. Its
# LICENSING summary uses the "GPLv3" abbreviation, which gen-sbom's
# detect_license maps to GPL-3.0-only -- contradicting the headers -- so pin the
# header-accurate SPDX id here. Commercial licensees can still override it
# (e.g. LicenseRef-wolfSSL-Commercial).
SBOM_LICENSE_OVERRIDE ?= GPL-3.0-or-later
include scripts/sbom.am