diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 8a08e91d4..79e0534eb 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -9,8 +9,7 @@ on: inputs: wolfssl_ref: description: 'wolfssl git ref that provides scripts/gen-sbom' - # TODO: switch back to 'master' once wolfSSL/wolfssl#10343 merges. - default: 'refs/pull/10343/head' + default: 'master' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -36,15 +35,13 @@ jobs: # built + installed here so wolfTPM has a library to link, and the same # source tree (scripts/gen-sbom + wolfssl/version.h) is passed to # `make sbom` via WOLFSSL_DIR -- so the recorded wolfSSL dependency - # version matches the linked one. gen-sbom is not yet on wolfssl master, - # so default to the open PR head that carries it (wolfSSL/wolfssl#10343) - # so CI actually exercises `make sbom` instead of silently skipping. - # TODO: switch the fallback back to 'master' once #10343 merges. + # version matches the linked one. gen-sbom landed on wolfssl master in + # wolfSSL/wolfssl#10343, so CI tracks master. - name: Checkout wolfssl (gen-sbom + library source) uses: actions/checkout@v4 with: repository: wolfSSL/wolfssl - ref: ${{ github.event.inputs.wolfssl_ref || 'refs/pull/10343/head' }} + ref: ${{ github.event.inputs.wolfssl_ref || 'master' }} path: wolfssl - name: Install build tooling and SBOM validator (pyspdxtools) diff --git a/README.md b/README.md index d50a40717..7cd41744c 100644 --- a/README.md +++ b/README.md @@ -1243,8 +1243,8 @@ make sbom WOLFSSL_DIR=/path/to/wolfssl ``` Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). `WOLFSSL_DIR` -must point to a wolfssl source tree containing `scripts/gen-sbom` (branch -`feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges). +must point to a wolfssl source tree containing `scripts/gen-sbom` (on `master` +since wolfSSL/wolfssl#10343). This is a source checkout, not an install prefix. Output: `wolftpm-.cdx.json`, `wolftpm-.spdx.json`, `wolftpm-.spdx` @@ -1265,9 +1265,10 @@ make uninstall-sbom ``` Note: recording wolfSSL as a dependency and emitting wolfTPM-specific project -URLs require the `gen-sbom` from wolfSSL/wolfssl#10343. Against an older -`gen-sbom`, `make sbom` still succeeds and produces a valid SBOM, but omits the -wolfSSL dependency entry and inherits wolfSSL's project URLs. +URLs require the `gen-sbom` added in wolfSSL/wolfssl#10343 and present on +wolfssl master. Against an older `gen-sbom`, `make sbom` still succeeds and +produces a valid SBOM, but omits the wolfSSL dependency entry and inherits +wolfSSL's project URLs. For further CRA guidance see [wolfssl/doc/CRA.md](https://github.com/wolfSSL/wolfssl/blob/master/doc/CRA.md). diff --git a/scripts/sbom.am b/scripts/sbom.am index bbc4942a5..aea85ba83 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -35,8 +35,13 @@ # detected from SBOM_LICENSE_FILE. # SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in # SBOM_LICENSE_OVERRIDE (required by SPDX 2.3). -# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency; -# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset. +# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When +# unset and WOLFSSL_DIR is set it is read from that tree: +# wolfssl/version.h, else configure.ac (version.h is +# generated, so 'make distclean' removes it). If neither +# is readable the build fails rather than letting gen-sbom +# fall back to pkg-config, which describes the installed +# wolfSSL rather than the tree at WOLFSSL_DIR. # SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency; # gen-sbom resolves it via pkg-config when unset. # @@ -150,19 +155,34 @@ sbom: | $(GREP) -q -- '--dep-wolfssl'; then \ dep_args="$$dep_args --dep-wolfssl yes"; \ wv="$(SBOM_WOLFSSL_VERSION)"; \ - if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ - wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \ - "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \ + if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ + wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \ + "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + fi; \ + if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ + wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ + "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ + fi; \ + if test -z "$$wv"; then \ + echo "ERROR: cannot determine the wolfSSL version from"; \ + echo " $(WOLFSSL_DIR)"; \ + echo " Neither wolfssl/version.h (generated by configure, so"; \ + echo " 'make distclean' removes it) nor configure.ac was"; \ + echo " readable. Refusing to fall back to pkg-config: that"; \ + echo " reports the *installed* wolfSSL, which may be a"; \ + echo " different build than WOLFSSL_DIR, and would record a"; \ + echo " wrong version in the SBOM. Re-run configure in that"; \ + echo " tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \ + exit 1; \ + fi; \ fi; \ if test -n "$$wv"; then \ dep_args="$$dep_args --dep-version wolfssl=$$wv"; \ fi; \ else \ echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \ - echo " will not list wolfssl as a dependency component. That"; \ - echo " support is added by wolfSSL/wolfssl#10343; until it merges"; \ - echo " to wolfssl master, point WOLFSSL_DIR at that PR's branch"; \ - echo " to enable it. The generated SBOM is valid either way."; \ + echo " will not list wolfssl as a dependency component."; \ fi; \ fi; \ if test "$(SBOM_DEP_OPENSSL)" = yes; then \