8cb188f127
Quote "$@" in gen-sbom --srcs (drop SC2068 disables), pass JSON paths to python via env var in validate.sh to prevent filename injection, and fail non-zero instead of warning when SBOM post-processing breaks. Rename the user_settings.h guard to CRA_KIT_USER_SETTINGS_H, clarify the serialNumber regex accepts v4 (product) and v5 (component) UUIDs, untrack the gitignored embedded sample SBOMs, document the SHA-512 CBOM omission, and note sample timestamp differences in SAMPLE-PROVENANCE.md. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| README.md | ||
README.md
Embedded component SBOM (optional sample)
This directory's wolfssl-*.{cdx,spdx}.json outputs are gitignored — generate
them locally with the embedded path. Only this README is committed.
export WOLFSSL_DIR=../../wolfssl # wolfSSL tree with scripts/gen-sbom
python3 -m pip install pcpp # same python3 as in your PATH (see README)
./scripts/generate-embedded-sbom.sh
If pcpp is not on your python3, the script falls back to cc -dM -E and --options-h
(no extra install). For cross builds, set CC=arm-none-eabi-gcc (or your target
compiler) so the fallback reflects target macros, not the host's.
Uses ../../user_settings.h via WOLFSSL_USER_SETTINGS and a
demo --srcs list (see scripts/generate-wolfssl-sbom.sh). Production firmware
must pass your user_settings.h and every wolfSSL .c file you compile.
Embedded outputs are watermarked wolfssl:sbom:demo=true so an auditor can tell at
a glance that they came from the kit's demo --srcs list and not a real build.
Outputs differ from ../wolfssl-component/ (autotools /
make sbom). Compare wolfssl:sbom:hash-kind in the CycloneDX files.