From 4fc59f586f1daf30f163d955c8c8abe52bdf3de3 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 12:49:19 -0700 Subject: [PATCH 1/2] fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config wolfssl/version.h is generated by configure as well as tracked, so `make distclean` removes it. With it gone the --dep-version override was never passed and gen-sbom fell back to pkg-config, recording the installed wolfSSL's version rather than the tree at WOLFSSL_DIR. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, and fail when a named tree yields neither source. With no WOLFSSL_DIR the pkg-config lookup remains the intended source. --- scripts/sbom.am | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/scripts/sbom.am b/scripts/sbom.am index bbc4942a5..c72871d3b 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -35,8 +35,13 @@ # detected from SBOM_LICENSE_FILE. # SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in # SBOM_LICENSE_OVERRIDE (required by SPDX 2.3). -# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency; -# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset. +# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When +# unset and WOLFSSL_DIR is set it is read from that tree: +# wolfssl/version.h, else configure.ac (version.h is +# generated, so 'make distclean' removes it). If neither +# is readable the build fails rather than letting gen-sbom +# fall back to pkg-config, which describes the installed +# wolfSSL rather than the tree at WOLFSSL_DIR. # SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency; # gen-sbom resolves it via pkg-config when unset. # @@ -150,9 +155,27 @@ sbom: | $(GREP) -q -- '--dep-wolfssl'; then \ dep_args="$$dep_args --dep-wolfssl yes"; \ wv="$(SBOM_WOLFSSL_VERSION)"; \ - if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ - wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \ - "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \ + if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ + wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \ + "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + fi; \ + if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ + wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ + "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ + fi; \ + if test -z "$$wv"; then \ + echo "ERROR: cannot determine the wolfSSL version from"; \ + echo " $(WOLFSSL_DIR)"; \ + echo " Neither wolfssl/version.h (generated by configure, so"; \ + echo " 'make distclean' removes it) nor configure.ac was"; \ + echo " readable. Refusing to fall back to pkg-config: that"; \ + echo " reports the *installed* wolfSSL, which may be a"; \ + echo " different build than WOLFSSL_DIR, and would record a"; \ + echo " wrong version in the SBOM. Re-run configure in that"; \ + echo " tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \ + exit 1; \ + fi; \ fi; \ if test -n "$$wv"; then \ dep_args="$$dep_args --dep-version wolfssl=$$wv"; \ From d003a76959eb57db1bf49ddf0d771addd99f2b87 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 12:51:26 -0700 Subject: [PATCH 2/2] fix(sbom): unpin CI from merged wolfSSL#10343, drop stale notes The SBOM workflow still checked out wolfssl at refs/pull/10343/head. That PR merged 2026-07-27, and GitHub keeps PR refs alive after merge, so CI stayed green while validating a pre-merge snapshot rather than master. Point wolfssl_ref and its fallback at master. Also drop the stale pre-merge guidance from the recipe NOTE (converging on the canonical wolfGlass wording) and from the README, both of which told users to track that PR's branch until it merged. --- .github/workflows/sbom.yml | 11 ++++------- README.md | 11 ++++++----- scripts/sbom.am | 5 +---- 3 files changed, 11 insertions(+), 16 deletions(-) diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 8a08e91d4..79e0534eb 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -9,8 +9,7 @@ on: inputs: wolfssl_ref: description: 'wolfssl git ref that provides scripts/gen-sbom' - # TODO: switch back to 'master' once wolfSSL/wolfssl#10343 merges. - default: 'refs/pull/10343/head' + default: 'master' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -36,15 +35,13 @@ jobs: # built + installed here so wolfTPM has a library to link, and the same # source tree (scripts/gen-sbom + wolfssl/version.h) is passed to # `make sbom` via WOLFSSL_DIR -- so the recorded wolfSSL dependency - # version matches the linked one. gen-sbom is not yet on wolfssl master, - # so default to the open PR head that carries it (wolfSSL/wolfssl#10343) - # so CI actually exercises `make sbom` instead of silently skipping. - # TODO: switch the fallback back to 'master' once #10343 merges. + # version matches the linked one. gen-sbom landed on wolfssl master in + # wolfSSL/wolfssl#10343, so CI tracks master. - name: Checkout wolfssl (gen-sbom + library source) uses: actions/checkout@v4 with: repository: wolfSSL/wolfssl - ref: ${{ github.event.inputs.wolfssl_ref || 'refs/pull/10343/head' }} + ref: ${{ github.event.inputs.wolfssl_ref || 'master' }} path: wolfssl - name: Install build tooling and SBOM validator (pyspdxtools) diff --git a/README.md b/README.md index d50a40717..7cd41744c 100644 --- a/README.md +++ b/README.md @@ -1243,8 +1243,8 @@ make sbom WOLFSSL_DIR=/path/to/wolfssl ``` Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). `WOLFSSL_DIR` -must point to a wolfssl source tree containing `scripts/gen-sbom` (branch -`feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges). +must point to a wolfssl source tree containing `scripts/gen-sbom` (on `master` +since wolfSSL/wolfssl#10343). This is a source checkout, not an install prefix. Output: `wolftpm-.cdx.json`, `wolftpm-.spdx.json`, `wolftpm-.spdx` @@ -1265,9 +1265,10 @@ make uninstall-sbom ``` Note: recording wolfSSL as a dependency and emitting wolfTPM-specific project -URLs require the `gen-sbom` from wolfSSL/wolfssl#10343. Against an older -`gen-sbom`, `make sbom` still succeeds and produces a valid SBOM, but omits the -wolfSSL dependency entry and inherits wolfSSL's project URLs. +URLs require the `gen-sbom` added in wolfSSL/wolfssl#10343 and present on +wolfssl master. Against an older `gen-sbom`, `make sbom` still succeeds and +produces a valid SBOM, but omits the wolfSSL dependency entry and inherits +wolfSSL's project URLs. For further CRA guidance see [wolfssl/doc/CRA.md](https://github.com/wolfSSL/wolfssl/blob/master/doc/CRA.md). diff --git a/scripts/sbom.am b/scripts/sbom.am index c72871d3b..aea85ba83 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -182,10 +182,7 @@ sbom: fi; \ else \ echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \ - echo " will not list wolfssl as a dependency component. That"; \ - echo " support is added by wolfSSL/wolfssl#10343; until it merges"; \ - echo " to wolfssl master, point WOLFSSL_DIR at that PR's branch"; \ - echo " to enable it. The generated SBOM is valid either way."; \ + echo " will not list wolfssl as a dependency component."; \ fi; \ fi; \ if test "$(SBOM_DEP_OPENSSL)" = yes; then \