- Replace fabricated library-binary SHA-256/SHA-1 with all-zeros sentinels
in the pinned wolfssl-component samples (cdx/spdx + commercial variants);
a non-reproducible binary hash must not ship in a copyable sample.
- Recompute product bom-link checksums (CycloneDX bom hash + SPDX
externalDocumentRef) to match the edited component SBOMs.
- Give the SPDX tag-value document a distinct documentNamespace so it no
longer collides with the JSON serialization (SPDX 2.3 sec 3.5).
- Add licenses (GPL-3.0-only) to the wolfssl component in the product CDX
(NTIA minimum elements).
- Align conformity-assessment-route.md wording to Annex III "important" /
Annex IV "critical", dropping the "class II" label.
- Document the sentinel digest in SAMPLE-PROVENANCE.md.
validate.sh passes (cross-document checksums + pyspdxtools schema).
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Plumb CRA_LICENSE_TEXT through generate-wolfssl-sbom.sh (gen-sbom/make
sbom hard-fail on a LicenseRef-* override without it); scope the
commercial relicense to the wolfssl package only; correct the stale
pkg:generic PURL claim; validate the embedded output dir; regenerate
pinned samples against gen-sbom 1.1 and re-pin product checksums.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Quote "$@" in gen-sbom --srcs (drop SC2068 disables), pass JSON paths to
python via env var in validate.sh to prevent filename injection, and fail
non-zero instead of warning when SBOM post-processing breaks. Rename the
user_settings.h guard to CRA_KIT_USER_SETTINGS_H, clarify the serialNumber
regex accepts v4 (product) and v5 (component) UUIDs, untrack the gitignored
embedded sample SBOMs, document the SHA-512 CBOM omission, and note sample
timestamp differences in SAMPLE-PROVENANCE.md.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Fail early when the wolfSSL tree version differs from the kit's pinned
VERSION instead of a cryptic cp error, trap-clean the embedded temp
defines file on all exit paths, add sh -n + shellcheck CI coverage for
the scripts, and use the standard file:./ relative form in the product
SBOM external references.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
- http_client_signed: check build_http_request() return before
send() and cast to size_t; free key on import_private_only
failure.
- http_server_verify: consolidate main() error paths around a
single "cleanup:" label so pubKey and listenFd are released
uniformly (import_public, socket, bind, listen).
- test_vectors: guard ed25519_free with per-key init flags so
the shared cleanup path never frees an uninitialized struct.
- wc_http_sig.h: document that WC_SF_MAX_STRING / WC_SF_MAX_ITEMS
drive ~12KB stack usage and must be tuned for embedded targets.
- wc_sf: reject *outSz > INT_MAX in wc_SfGenSigParams and
wc_SfGenSigInput to guard word32 -> int casts (matches
build_signature_base).
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
- LoadFile now validates fread read the full file size and returns NULL
on short read.
- ocsp-responder-http checks wolfSSL_Init return value.
- Remove bare scope block around sigaction setup.
- Add SO_RCVTIMEO (5s) on accepted client sockets to prevent indefinite
blocking from incomplete requests
- Move 64KB httpBuf/respBuf from stack to static globals
- Fix SendAll infinite loop when send() returns 0 (check n <= 0)
- Ignore SIGPIPE to prevent crash on client disconnect during writes
- Use case-insensitive Content-Length header matching per RFC 7230
- Track error state and return nonzero from main on fatal errors
- Reset ret after wolfSSL_CertManagerLoadCABuffer to avoid leaking
WOLFSSL_SUCCESS (1) into error paths in ocsp-request-response.c
- Add -Wextra to Makefile CFLAGS
- Add missing <time.h> include for time(NULL) usage
- Replace atoi() with strtol() and validate Content-Length in RecvHttp
and ParsePost to reject negative/overflowing values
- Add SendAll() helper to handle partial send() writes
- Check return values of socket(), setsockopt(), and listen()
Three examples demonstrating the new OCSP Responder API:
1. ocsp-request-response.c - Pure API usage: encode DER OCSP requests
from certificates, generate signed responses, and verify them
in memory without networking.
2. ocsp-responder-http.c - Minimal HTTP server that accepts POST
requests with DER OCSP payloads and returns signed responses.
3. nginx-scgi/ - Production-style deployment using nginx as HTTP
frontend with wolfclu running as an SCGI backend for OCSP
processing.
* Don't require FreeRTOS if we are doing a bare metal bench / test build
* Make stack checking stricter and increase stack size for DH
* Set alignment to 0, this fixes LMS if that is compiled-in
* `WOLFSSL_SP_MATH` and `WOLFSSL_SP_MATH_ALL` can't be used together
* Loop the benchmark
Sameeh Jubran
David Garske
Kaleb Himes
Lealem Amedie
Paul Adelsbach
Juliusz Sosinowicz
Juliusz Sosinowicz
night1rider
tmael
JacobBarthelmeh
Eric Blankenhorn
sebastian-carpenter
Anthony Hu
Daniele Lacamera
Andrew Hutchings