generate-wolfssh: add missing _cra_auto_tempfiles init (SC2154). generate-wolfhsm: make CRA_SBOM_BUILD_DIR self-referential so shellcheck sees the sourced-helper use (SC2034). Rewrite pipefail probe as if-then; annotate the sourced-helper (SC1091) and intentional cd-fallback (SC2015) lines. shellcheck cra-kit/scripts/*.sh now exits 0.
Makefile: add --no-print-directory to suppress make's Entering/Leaving
directory banners, which leaked into the source list when the Makefile
directory path contained "wolfssl".
Keil CMSIS Pack: when the wolfSSL pack .pdsc is not installed locally
(~/.arm/Packs/wolfSSL/), fall back to enumerating wolfcrypt/src/*.c
and src/*.c from WOLFSSL_DIR. The full library is what the pack ships.
Adds _auto_extract_srcs() to generate-wolfssl-sbom.sh. When
CRA_SBOM_SRCS_FILE is not set, the embedded path now tries four
methods in order:
1. compile_commands.json (CMake/Zephyr/ESP-IDF) via jq — triggered
when WOLFSSL_BUILD_DIR is set; detects ESP-IDF managed_components
layout automatically.
2. Makefile via CRA_SBOM_MAKEFILE_DIR — tries print-wolfssl-srcs
target first, falls back to make -n grep.
3. Keil .uvprojx via CRA_SBOM_KEIL_PROJECT — handles both CMSIS
Pack RTE and explicit FilePath layouts.
4. IAR .ewp via CRA_SBOM_IAR_PROJECT — resolves $PROJ_DIR$,
skips excluded entries.
All methods set CRA_SBOM_SRCS_ONLY_FROM_FILE=true automatically so
the demo watermark is suppressed. Temp files are collected into a
single global trap. SRCS-FILE-HOWTO.md gains an Automatic extraction
subsection for each build system.
cmake -L and -LA both exclude :STATIC (internal) cache entries, so
CMAKE_PROJECT_VERSION:STATIC was never matched and the version mismatch
check was dead code. Grep CMakeCache.txt directly instead.
When CRA_SBOM_SRCS_ONLY_FROM_FILE=true no demo srcs are added to $@,
so passing --srcs "$@" fed --cdx-out as the first --srcs argument,
causing argparse to error. Capture _srcs_flag before output flags are
appended; emit it only when positional srcs are present.
Plumb CRA_LICENSE_TEXT through generate-wolfssl-sbom.sh (gen-sbom/make
sbom hard-fail on a LicenseRef-* override without it); scope the
commercial relicense to the wolfssl package only; correct the stale
pkg:generic PURL claim; validate the embedded output dir; regenerate
pinned samples against gen-sbom 1.1 and re-pin product checksums.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Quote "$@" in gen-sbom --srcs (drop SC2068 disables), pass JSON paths to
python via env var in validate.sh to prevent filename injection, and fail
non-zero instead of warning when SBOM post-processing breaks. Rename the
user_settings.h guard to CRA_KIT_USER_SETTINGS_H, clarify the serialNumber
regex accepts v4 (product) and v5 (component) UUIDs, untrack the gitignored
embedded sample SBOMs, document the SHA-512 CBOM omission, and note sample
timestamp differences in SAMPLE-PROVENANCE.md.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Fail early when the wolfSSL tree version differs from the kit's pinned
VERSION instead of a cryptic cp error, trap-clean the embedded temp
defines file on all exit paths, add sh -n + shellcheck CI coverage for
the scripts, and use the standard file:./ relative form in the product
SBOM external references.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Mark Atwood
Sameeh Jubran