From 48fc50c9bc3380fa011d1756b0174725515ab693 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 07:51:25 -0700 Subject: [PATCH] fix: read wolfSSL version from WOLFSSL_DIR only The wolfSSL dependency version came solely from WOLFSSL_DIR/wolfssl/version.h. That header is generated by configure as well as tracked, so `make distclean` in the wolfSSL tree removes it. With it gone the --dep-version override was never passed and gen-sbom fell back to `pkg-config --modversion wolfssl`, which reports the *installed* wolfSSL. On a host whose installed build differs from WOLFSSL_DIR the SBOM recorded that unrelated version (9.9.9 in the report) and still exited 0, attesting a component wolfSSH was not built against. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, which survives distclean, and fail when neither source is readable rather than letting an installed copy answer for the tree. SBOM_WOLFSSL_VERSION still overrides both. --- README.md | 11 ++++++++--- scripts/sbom.am | 27 +++++++++++++++++++++++---- 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index f2318a72..7b547877 100644 --- a/README.md +++ b/README.md @@ -726,9 +726,14 @@ Optional overrides: licensees). - `SBOM_LICENSE_TEXT` - path to the licence text for any `LicenseRef-*` used in `SBOM_LICENSE_OVERRIDE` (required by SPDX 2.3). -- `SBOM_WOLFSSL_VERSION` - version recorded for the wolfSSL dependency; - auto-detected from `WOLFSSL_DIR/wolfssl/version.h` (or wolfSSL's `pkg-config` - entry) when unset. +- `SBOM_WOLFSSL_VERSION` - version recorded for the wolfSSL dependency. When + unset it is read from `WOLFSSL_DIR/wolfssl/version.h`, falling back to + `AC_INIT` in `WOLFSSL_DIR/configure.ac`. Note `wolfssl/version.h` is generated + by configure, so `make distclean` in the wolfSSL tree removes it until you + re-run configure; the `configure.ac` fallback covers that case. If neither is + readable, `make sbom` fails rather than falling back to `pkg-config`, which + reports the *installed* wolfSSL and may describe a different build than + `WOLFSSL_DIR`. ```sh make install-sbom # installs to $(datadir)/doc/wolfssh/ diff --git a/scripts/sbom.am b/scripts/sbom.am index 92b3bdca..36437f9c 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -36,8 +36,13 @@ # detected from SBOM_LICENSE_FILE. # SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in # SBOM_LICENSE_OVERRIDE (required by SPDX 2.3). -# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency; -# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset. +# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When +# unset it is read from WOLFSSL_DIR/wolfssl/version.h, +# else from WOLFSSL_DIR/configure.ac (version.h is +# generated, so 'make distclean' removes it). If neither +# is readable the build fails rather than letting gen-sbom +# fall back to pkg-config, which describes the installed +# wolfSSL rather than the one at WOLFSSL_DIR. # SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency; # gen-sbom resolves it via pkg-config when unset. # SBOM_CONFIG_H Path to the configure-generated config header to @@ -179,9 +184,23 @@ sbom: wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ fi; \ - if test -n "$$wv"; then \ - dep_args="$$dep_args --dep-version wolfssl=$$wv"; \ + if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ + wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ + "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ fi; \ + if test -z "$$wv"; then \ + echo "ERROR: cannot determine the wolfSSL version from"; \ + echo " $(WOLFSSL_DIR)"; \ + echo " Neither wolfssl/version.h (removed by 'make distclean',"; \ + echo " restored by configure) nor configure.ac was readable."; \ + echo " Refusing to fall back to pkg-config: that reports the"; \ + echo " *installed* wolfSSL, which may be a different build"; \ + echo " than WOLFSSL_DIR, and would record a wrong version in"; \ + echo " the SBOM. Re-run configure in that tree, or pass"; \ + echo " SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \ + exit 1; \ + fi; \ + dep_args="$$dep_args --dep-version wolfssl=$$wv"; \ else \ echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \ echo " will not list wolfssl as a dependency component. That"; \