WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

sbom: harden gen-sbom path resolution and align docs 

Guard the SBOM_GEN wolfSSL fallback with $(if $(WOLFSSL_DIR),...) so an
unset WOLFSSL_DIR leaves it empty (yielding the intended "set WOLFSSL_DIR"
error) instead of resolving to an absolute /scripts/gen-sbom that could run
an unrelated host script. Reword the fragment header to describe the actual
gen-sbom resolution (vendored copy if present, else WOLFSSL_DIR) rather than
claiming offline tarball builds that aren't wired up yet. Condition the
README's wolfSSL-dependency statement on a sufficiently new gen-sbom to
match the existing degradation note.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
pull/1201/head
Sameeh Jubran 2026-07-09 07:30:16 +03:00 committed by John Safranek
parent 5323b26b0a
commit f0e4b404d5
2 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -702,9 +702,10 @@ the apps directory for more information.
wolfSSH generates a Software Bill of Materials (SBOM) in CycloneDX 1.6 and
SPDX 2.3 formats to support compliance with the EU Cyber Resilience Act (CRA).
The SBOM records the configured build options, hashes the built library
artifact (shared or static; ELF, Mach-O, or PE), and lists wolfSSL as a
dependency so vulnerability scanners can associate wolfSSL advisories with a
wolfSSH deployment. Output is reproducible: set `SOURCE_DATE_EPOCH` (or build
artifact (shared or static; ELF, Mach-O, or PE), and (with a sufficiently new
`gen-sbom`) lists wolfSSL as a dependency so vulnerability scanners can
associate wolfSSL advisories with a wolfSSH deployment. Output is reproducible:
set `SOURCE_DATE_EPOCH` (or build
from a git checkout, which uses the last commit time) and repeated runs are
byte-identical.

14
scripts/sbom.am
View File

@ -5,9 +5,11 @@
# sets a few variables (below) and does `include scripts/sbom.am` to get the
# `sbom`, `install-sbom` and `uninstall-sbom` targets.
#
# The canonical copy lives in the wolfSSL repository (scripts/sbom.am); every
# product vendors a byte-identical copy so `make sbom` works from an unpacked
# release tarball, offline. Keep the copies in sync.
# The canonical copy lives in the wolfSSL repository (scripts/sbom.am); keep
# product copies in sync. gen-sbom is taken from a vendored scripts/gen-sbom
# if a product ships one (used automatically), otherwise from a wolfSSL source
# tree via WOLFSSL_DIR. wolfSSH uses the WOLFSSL_DIR route; vendoring gen-sbom
# for fully offline tarball builds can be added later with no change here.
#
# ---------------------------------------------------------------------------
# The including Makefile.am MUST set, before `include scripts/sbom.am`:
@ -53,8 +55,12 @@ SBOM_SPDX_TV = $(SBOM_PKGNAME)-$(PACKAGE_VERSION).spdx
sbomdir = $(datadir)/doc/$(PACKAGE)
# Prefer a vendored gen-sbom; fall back to an external wolfSSL source tree.
# The fallback is $(wildcard)-guarded and only consulted when WOLFSSL_DIR is
# set, so an unset WOLFSSL_DIR leaves SBOM_GEN empty (and the sbom recipe's
# `test -f` prints the "set WOLFSSL_DIR" error) rather than resolving to an
# absolute /scripts/gen-sbom that could run an unrelated host script.
SBOM_GEN = $(firstword $(wildcard $(srcdir)/scripts/gen-sbom) \
$(WOLFSSL_DIR)/scripts/gen-sbom)
$(if $(WOLFSSL_DIR),$(wildcard $(WOLFSSL_DIR)/scripts/gen-sbom)))
# Library artifact search order (versioned first) covering ELF, Mach-O and PE.
# Windows import libs (.lib) come with and without the "lib" prefix.