- Replace fabricated library-binary SHA-256/SHA-1 with all-zeros sentinels
in the pinned wolfssl-component samples (cdx/spdx + commercial variants);
a non-reproducible binary hash must not ship in a copyable sample.
- Recompute product bom-link checksums (CycloneDX bom hash + SPDX
externalDocumentRef) to match the edited component SBOMs.
- Give the SPDX tag-value document a distinct documentNamespace so it no
longer collides with the JSON serialization (SPDX 2.3 sec 3.5).
- Add licenses (GPL-3.0-only) to the wolfssl component in the product CDX
(NTIA minimum elements).
- Align conformity-assessment-route.md wording to Annex III "important" /
Annex IV "critical", dropping the "class II" label.
- Document the sentinel digest in SAMPLE-PROVENANCE.md.
validate.sh passes (cross-document checksums + pyspdxtools schema).
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Plumb CRA_LICENSE_TEXT through generate-wolfssl-sbom.sh (gen-sbom/make
sbom hard-fail on a LicenseRef-* override without it); scope the
commercial relicense to the wolfssl package only; correct the stale
pkg:generic PURL claim; validate the embedded output dir; regenerate
pinned samples against gen-sbom 1.1 and re-pin product checksums.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Sameeh Jubran