WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: read wolfSSL version from WOLFSSL_DIR only 

The wolfSSL dependency version came solely from
WOLFSSL_DIR/wolfssl/version.h. That header is generated by configure as
well as tracked, so `make distclean` in the wolfSSL tree removes it. With
it gone the --dep-version override was never passed and gen-sbom fell
back to `pkg-config --modversion wolfssl`, which reports the *installed*
wolfSSL. On a host whose installed build differs from WOLFSSL_DIR the
SBOM recorded that unrelated version (9.9.9 in the report) and still
exited 0, attesting a component wolfSSH was not built against.

Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, which survives
distclean, and fail when neither source is readable rather than letting
an installed copy answer for the tree. SBOM_WOLFSSL_VERSION still
overrides both.
pull/1201/head
Mark Atwood 2026-08-26 07:51:25 -07:00 committed by John Safranek
parent f8f580b878
commit 48fc50c9bc
2 changed files with 31 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@ -726,9 +726,14 @@ Optional overrides:
licensees).
- `SBOM_LICENSE_TEXT` - path to the licence text for any `LicenseRef-*` used in
`SBOM_LICENSE_OVERRIDE` (required by SPDX 2.3).
- `SBOM_WOLFSSL_VERSION` - version recorded for the wolfSSL dependency;
auto-detected from `WOLFSSL_DIR/wolfssl/version.h` (or wolfSSL's `pkg-config`
entry) when unset.
- `SBOM_WOLFSSL_VERSION` - version recorded for the wolfSSL dependency. When
unset it is read from `WOLFSSL_DIR/wolfssl/version.h`, falling back to
`AC_INIT` in `WOLFSSL_DIR/configure.ac`. Note `wolfssl/version.h` is generated
by configure, so `make distclean` in the wolfSSL tree removes it until you
re-run configure; the `configure.ac` fallback covers that case. If neither is
readable, `make sbom` fails rather than falling back to `pkg-config`, which
reports the *installed* wolfSSL and may describe a different build than
`WOLFSSL_DIR`.
```sh
make install-sbom # installs to $(datadir)/doc/wolfssh/

27
scripts/sbom.am
View File

@ -36,8 +36,13 @@
# detected from SBOM_LICENSE_FILE.
# SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in
# SBOM_LICENSE_OVERRIDE (required by SPDX 2.3).
# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency;
# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset.
# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When
# unset it is read from WOLFSSL_DIR/wolfssl/version.h,
# else from WOLFSSL_DIR/configure.ac (version.h is
# generated, so 'make distclean' removes it). If neither
# is readable the build fails rather than letting gen-sbom
# fall back to pkg-config, which describes the installed
# wolfSSL rather than the one at WOLFSSL_DIR.
# SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency;
# gen-sbom resolves it via pkg-config when unset.
# SBOM_CONFIG_H Path to the configure-generated config header to
@ -179,9 +184,23 @@ sbom:
wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
"$(WOLFSSL_DIR)/wolfssl/version.h"`; \
fi; \
if test -n "$$wv"; then \
dep_args="$$dep_args --dep-version wolfssl=$$wv"; \
if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \
wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \
"$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \
fi; \
if test -z "$$wv"; then \
echo "ERROR: cannot determine the wolfSSL version from"; \
echo " $(WOLFSSL_DIR)"; \
echo " Neither wolfssl/version.h (removed by 'make distclean',"; \
echo " restored by configure) nor configure.ac was readable."; \
echo " Refusing to fall back to pkg-config: that reports the"; \
echo " *installed* wolfSSL, which may be a different build"; \
echo " than WOLFSSL_DIR, and would record a wrong version in"; \
echo " the SBOM. Re-run configure in that tree, or pass"; \
echo " SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \
exit 1; \
fi; \
dep_args="$$dep_args --dep-version wolfssl=$$wv"; \
else \
echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \
echo " will not list wolfssl as a dependency component. That"; \