From 2368fd0eac4dc5221f7d20a785f85b097c01f11b Mon Sep 17 00:00:00 2001 From: Sameeh Jubran Date: Thu, 9 Jul 2026 12:29:04 +0300 Subject: [PATCH] sbom: add --dep-openssl for OpenSSL-compat products Add an openssl entry to DEP_META (Apache-2.0, OpenSSL 3.x git-tag purl) and a --dep-openssl flag so OpenSSL-compat products (wolfProvider, wolfEngine) can record OpenSSL as a dependency component alongside wolfSSL. Update tests. Signed-off-by: Sameeh Jubran --- scripts/gen-sbom | 22 ++++++++++++++++++++++ scripts/test_gen_sbom.py | 21 ++++++++++++++++++--- 2 files changed, 40 insertions(+), 3 deletions(-) diff --git a/scripts/gen-sbom b/scripts/gen-sbom index e58e8efa28..f90b3f450e 100755 --- a/scripts/gen-sbom +++ b/scripts/gen-sbom @@ -145,6 +145,21 @@ DEP_META = { # vendor:product mapping a pkg:generic PURL would force. 'purl': lambda v: f'pkg:github/madler/zlib@{v}', }, + # openssl, declared as a dependency by the OpenSSL-compat products + # (wolfProvider, wolfEngine) that link libcrypto/libssl alongside wolfSSL. + # Only emitted when the caller passes --dep-openssl yes. These products + # target the OpenSSL 3.x provider/engine ABI, which is Apache-2.0 (older + # 1.1.x was the SPDX "OpenSSL" licence); Apache-2.0 is therefore the correct + # id for the supported surface. The purl uses OpenSSL 3.x's "openssl-X.Y.Z" + # git tag form so it resolves in OSV / GHSA. + 'openssl': { + 'name': 'openssl', + 'supplier': 'OpenSSL Software Foundation', + 'license': 'Apache-2.0', + 'download': 'https://github.com/openssl/openssl', + 'pkgconfig': 'openssl', + 'purl': lambda v: f'pkg:github/openssl/openssl@openssl-{v}', + }, } @@ -1162,6 +1177,12 @@ def main(): 'wolfSSL\'s own SBOM leaves this off. Combine ' 'with --dep-version wolfssl=X.Y.Z on hosts ' 'without wolfssl.pc.') + parser.add_argument('--dep-openssl', default='no', + help='yes to record openssl as a dependency component ' + '(for OpenSSL-compat products such as wolfProvider ' + '/ wolfEngine that link libcrypto/libssl). Combine ' + 'with --dep-version openssl=X.Y.Z on hosts without ' + 'openssl.pc.') parser.add_argument('--dep-libz', default='no', help='yes if built with --with-libz') parser.add_argument('--dep-liboqs', default='no', @@ -1234,6 +1255,7 @@ def main(): enabled_deps = [ key for key, flag in [ ('wolfssl', args.dep_wolfssl), + ('openssl', args.dep_openssl), ('libz', args.dep_libz), ('liboqs', args.dep_liboqs), ] diff --git a/scripts/test_gen_sbom.py b/scripts/test_gen_sbom.py index 134c4ec828..3a38ad9e2b 100644 --- a/scripts/test_gen_sbom.py +++ b/scripts/test_gen_sbom.py @@ -828,10 +828,11 @@ class TestDepMetaShape(unittest.TestCase): def test_only_expected_deps_are_tracked(self): # wolfssl is tracked so downstream wolfSSL-stack products (wolfSSH, - # wolfMQTT, ...) can declare it via --dep-wolfssl; libz/liboqs are - # wolfSSL's own optional linked deps. + # wolfMQTT, ...) can declare it via --dep-wolfssl; openssl so the + # OpenSSL-compat products (wolfProvider, wolfEngine) can declare it via + # --dep-openssl; libz/liboqs are wolfSSL's own optional linked deps. self.assertEqual(set(gs.DEP_META.keys()), - {'wolfssl', 'libz', 'liboqs'}) + {'wolfssl', 'openssl', 'libz', 'liboqs'}) def test_wolfssl_dep_entry_describes_the_linked_artefact(self): wolfssl = gs.DEP_META['wolfssl'] @@ -847,6 +848,19 @@ class TestDepMetaShape(unittest.TestCase): wolfssl['purl']('5.7.4'), 'pkg:github/wolfSSL/wolfssl@v5.7.4') + def test_openssl_dep_entry_describes_the_linked_artefact(self): + openssl = gs.DEP_META['openssl'] + self.assertEqual(openssl['name'], 'openssl') + self.assertEqual(openssl['supplier'], 'OpenSSL Software Foundation') + self.assertEqual(openssl['pkgconfig'], 'openssl') + # wolfProvider / wolfEngine target the OpenSSL 3.x provider/engine ABI, + # which is Apache-2.0. The purl uses OpenSSL 3.x's "openssl-X.Y.Z" git + # tag form so it resolves in OSV / GHSA. + self.assertEqual(openssl['license'], 'Apache-2.0') + self.assertEqual( + openssl['purl']('3.5.0'), + 'pkg:github/openssl/openssl@openssl-3.5.0') + def test_liboqs_entry_describes_the_linked_artefact(self): liboqs = gs.DEP_META['liboqs'] self.assertEqual(liboqs['name'], 'liboqs') @@ -887,6 +901,7 @@ class TestEnabledDepsCli(unittest.TestCase): self.assertIn('--dep-liboqs', result.stdout) self.assertIn('--dep-libz', result.stdout) self.assertIn('--dep-wolfssl', result.stdout) + self.assertIn('--dep-openssl', result.stdout) def test_removed_flags_are_rejected(self): # Each of these was either renamed (--dep-falcon -> --dep-liboqs)