feat: add make sbom / install-sbom / uninstall-sbom targets by MarkAtwood · Pull Request #410 · wolfSSL/wolfProvider

MarkAtwood · 2026-06-23T22:35:04Z

Summary

Adds make sbom, make install-sbom, and make uninstall-sbom targets to wolfProvider's autotools build for EU CRA compliance evidence (CycloneDX 1.6 + SPDX 2.3 output)
Adds AC_CHECK_PROG checks for python3 and pyspdxtools in configure.ac

Usage

make sbom WOLFSSL_DIR=/path/to/wolfssl
# produces: wolfprov-1.1.1.cdx.json  wolfprov-1.1.1.spdx.json  wolfprov-1.1.1.spdx
pyspdxtools --infile wolfprov-1.1.1.spdx.json   # must pass

make install-sbom   # installs to $(datadir)/doc/wolfprov/
make uninstall-sbom

WOLFSSL_DIR must point to a wolfssl checkout containing scripts/gen-sbom (branch feat/sbom-embedded, or master once wolfSSL/wolfssl#10343 merges).

Notes

Product name is wolfprov throughout (matches AC_INIT and lib_LTLIBRARIES), not wolfprovider
No generated options.h; uses installed wolfssl's options.h via $(WOLFSSL_INCLUDEDIR)/wolfssl/options.h. WOLFSSL_DIR defaults to $(WOLFSSL_INSTALL_DIR) (set by --with-wolfssl= at configure time)
wolfProvider's libtool default SONAME is libwolfprov.so.0.0.0 (no -version-info set) — --lib path uses this literal, not the package version 1.1.1
Known limitation: if wolfssl was found via pkg-config rather than --with-wolfssl, WOLFSSL_INSTALL_DIR may be malformed; pass WOLFSSL_DIR= explicitly in that case

Copilot

Pull request overview

Adds SBOM generation and install/uninstall targets to the autotools build so wolfProvider can emit CycloneDX 1.6 and SPDX 2.3 artifacts (via wolfSSL’s gen-sbom script), plus configure-time discovery of required tooling.

Changes:

Add make sbom, make install-sbom, and make uninstall-sbom targets that stage-install the built artifacts and generate CycloneDX/SPDX outputs.
Add AC_CHECK_PROG checks for python3 and pyspdxtools in configure.ac.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
Makefile.am	Adds SBOM generation and install/uninstall targets and related variables.
configure.ac	Adds checks for `python3` and `pyspdxtools` availability.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

aidangarske

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 2 total — 2 posted, 0 skipped

Posted findings

[High] SBOM version lookup breaks clean out-of-tree builds and overrides Automake VERSION — Makefile.am:60-71
[Medium] pyspdxtools probe is never enforced by the sbom target — configure.ac:30, Makefile.am:80-83

Review generated by Skoll.

MarkAtwood · 2026-07-09T19:41:29Z

Both Skoll findings are against code that isn't in this PR (verified against the current head):

"VERSION grep at Makefile.am:60" — line 60 is a comment. There is no VERSION = assignment and no include/wolfprovider/version.h grep anywhere in the diff. SBOM filenames use $(PACKAGE_VERSION) (see scripts/sbom.am), so the "empty version / overrides Automake VERSION" symptom can't occur. The only version.h reads in the PR are the gated wolfSSL dependency version, a separate variable.
"pyspdxtools probe never enforced" — the recipe enforces it before gen-sbom runs: scripts/sbom.am:95 has @test -n "$(PYSPDXTOOLS)" || { echo "ERROR: 'pyspdxtools' not found ..."; exit 1; }.

The recipe was refactored into the shared scripts/sbom.am (byte-identical to the wolfssh copy); the flagged lines predate that refactor. CI is green. Requesting a re-review / dismissal of the stale change-request.

MarkAtwood · 2026-07-09T19:47:07Z

Detailed verification — both Skoll findings are against code that isn't in this PR

Checked two ways against the reviewed head 611ccd038f14663e74e8225eb8fe821ff8290293: statically on a fresh clone, and empirically via this PR's own make sbom CI. Neither finding reproduces.

Finding 1 — "VERSION grep at `Makefile.am:60` overrides Automake `VERSION`"

No VERSION = … assignment exists in any Makefile.am, *.am, or configure.ac. grep -rnE '^[[:space:]]*VERSION[[:space:]]*[:]?=' over a clean clone of the head returns nothing.
The only references to include/wolfprovider/version.h are benign: configure.ac:211 (an AC_CONFIG_FILES output generated from version.h.in) and include/include.am:7 (header install). Neither greps a version for the SBOM.
SBOM output names use $(PACKAGE_VERSION), not $(VERSION):
- scripts/sbom.am:52-54 — SBOM_CDX = $(SBOM_PKGNAME)-$(PACKAGE_VERSION).cdx.json (and .spdx.json, .spdx)
- scripts/sbom.am:172 — gen-sbom is passed --version $(PACKAGE_VERSION)
PACKAGE_VERSION is set by AC_INIT, so it cannot be empty — the wolfprov-.spdx symptom described in the finding cannot occur.
Makefile.am:60 is a comment line (# … make sbom WOLFSSL_DIR=/path/to/wolfssl.), not a VERSION assignment.

Finding 2 — "pyspdxtools probe never enforced by the sbom target"

It is enforced before the generator runs: scripts/sbom.am:95 — @test -n "$(PYSPDXTOOLS)" || { echo "ERROR: 'pyspdxtools' not found (pip install spdx-tools)."; exit 1; }
And it is used: scripts/sbom.am:182 — $(PYSPDXTOOLS) --infile $(SBOM_SPDX) --outfile $(SBOM_SPDX_TV) (SPDX → tag-value).

Empirical — `make sbom` builds and passes on this exact SHA

The SBOM Test workflow (run https://github.com/wolfSSL/wolfProvider/actions/runs/29008558830) built the full openssl + wolfssl + wolfprovider stack from source and ran make sbom on 611ccd038. Every step passed, including:

Generate SBOM — make sbom ran end-to-end
Outputs exist and SPDX validates — pyspdxtools --infile validated the generated SPDX
CycloneDX identity and licence — asserts a versioned purl (pkg:github/wolfSSL/wolfprovider@…) and GPL-3.0-or-later
Reproducible across two runs, wolfssl / openssl recorded as dependencies

If the version were empty or pyspdxtools weren't wired, those steps would fail — they pass.

Both findings are incorrect against the current head. CI is green; requesting the change-request be dismissed so this can proceed.

aidangarske

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 2 total — 2 posted, 0 skipped

Posted findings

[High] SBOM option capture omits configured compiler defines — scripts/sbom.am:129-131
[Low] SBOM workflow executes mutable external gen-sbom ref — .github/workflows/sbom.yml:42-47

Review generated by Skoll.

dgarske

@sameehj or @MarkAtwood please see feedback #410 (review)

MarkAtwood · 2026-07-10T20:29:58Z

On the second finding (mutable gen-sbom ref in the workflow): pinned. The Checkout wolfssl (gen-sbom source) step and the workflow_dispatch default now fetch the immutable commit SHA 0a32b47b962aa626820f3cc2af5ee32ab348924a (current head of wolfSSL/wolfssl#10343) instead of refs/pull/10343/head, so a force-push can't silently change the gen-sbom CI runs. A TODO notes this moves to the wolfssl release/master copy once #10343 merges.

JacobBarthelmeh · 2026-08-12T17:10:33Z

Retest this please Jenkins. @aidangarske , @dgarske it looks like the review comments got marked as resolved. Can you re-review?

aidangarske

CI needs some work thanks

sameehj · 2026-08-13T11:12:55Z

Addressed the 12 Aug review (#410 (review)):

Rebased onto current wolfSSL/wolfProvider master.
Vendored wolfGlass into tools/sbom/ (pin d34a906, 0.1.0-draft). make sbom no longer needs a wolfSSL source tree for gen-sbom.
Full SBOM CI is no longer on every PR. It runs on the nightly suite and on PRs labeled ci:sbom. The linked wolfSSL is built from master.

A per-PR make sbom smoke is not cheaper here: wolfProvider cannot configure without a built OpenSSL + wolfSSL stack, which is the expensive part of the full job.

Add CycloneDX + SPDX SBOM targets (make sbom / install-sbom / uninstall-sbom) using the wolfGlass toolkit under tools/sbom/. wolfProvider records wolfSSL and OpenSSL as dependencies, pins SBOM_CONFIG_H at include/config.h, and runs the full stack job on nightly and the ci:sbom label. Do not assign SBOM_GEN or SBOM_VENDOR_DIR in Makefile.am: Automake -Werror treats a second assignment in the included fragment as fatal. Pass the raw OpenSSL version (including BUILD_METADATA) to gen-sbom. CPE 2.3 and PURL identifiers drop the +suffix; versionInfo keeps it. Co-authored-by: Mark Atwood <mark@wolfssl.com> Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

purl-spec requires pkg:github namespace and name to be lowercased. gen-sbom already emits pkg:github/wolfssl/wolfprovider@...; the CI assert still looked for wolfSSL and failed the identity step. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

aidangarske · 2026-08-24T21:06:35Z

 * ML-DSA (FIPS 204): ML-DSA-44, ML-DSA-65, ML-DSA-87 (signatures, pure mode with empty context per FIPS 204 sec 5.2)


+## SBOM / EU CRA Compliance


This is not the right spot for this documentation I would suggest creating a SBOM.md or better a chapter in the documentation repo for WP

aidangarske

Skoll Code Review

Scan type: review

Overall recommendation: COMMENT
Findings: 3 total — 1 posted, 2 skipped
1 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Low] SBOM package name (wolfprovider) diverges from autoconf package (wolfprov) — Makefile.am:63

Skipped findings

[Info] ~~Redundant AC_SUBST calls after AC_PATH_PROG~~
[Info] ~~EXTRA_DIST of tools/sbom directory is not .gitignore-aware~~

Review generated by Skoll

aidangarske · 2026-08-24T21:21:00Z

+# next to the fragment, so `make sbom` does not need a wolfSSL source tree.
+# Set WOLFSSL_DIR only when you want the SBOM to read the linked wolfSSL
+# version from wolfssl/version.h.
+SBOM_PKGNAME      = wolfprovider


SBOM package name (wolfprovider) diverges from autoconf package (wolfprov)

SBOM_PKGNAME = wolfprovider but configure.ac:8 declares AC_INIT([wolfprov], [1.2.1]) and SBOM_LIB_STEM = libwolfprov. Consequences: (1) make sbom produces wolfprovider-1.2.1.* files, yet sbom.am sets sbomdir = $(docdir) which defaults to $(datarootdir)/doc/$(PACKAGE) = .../doc/wolfprov/, so install-sbom drops wolfprovider-* files into a wolfprov-named directory; (2) the SBOM component name / purl (wolfprovider) does not match the autoconf package identifier (wolfprov). The GitHub repo is wolfProvider, so the lowercased wolfprovider purl is defensible, but the split identity (wolfprovider in the SBOM, wolfprov for $(PACKAGE)/libwolfprov/docdir) is easy to trip over. The PR body's own Notes section originally stated the name should be wolfprov "throughout (matches AC_INIT and lib_LTLIBRARIES), not wolfprovider", so the two names are worth reconciling or documenting deliberately. This is not a build break (all paths resolve), just an identity inconsistency.

Fix: Confirm wolfprovider is the intended canonical SBOM/purl name and, if so, add a one-line comment noting it deliberately differs from $(PACKAGE)/libwolfprov (repo is github.com/wolfSSL/wolfProvider). Otherwise align SBOM_PKGNAME with $(PACKAGE) (wolfprov) so the output filenames match the doc install directory.

Copilot AI review requested due to automatic review settings June 23, 2026 22:35

Copilot started reviewing on behalf of MarkAtwood June 23, 2026 22:35 View session

MarkAtwood requested a review from sameehj June 23, 2026 22:36

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Comment thread Makefile.am Outdated

Comment thread Makefile.am Outdated

Comment thread Makefile.am Outdated

aidangarske assigned MarkAtwood Jun 24, 2026

MarkAtwood force-pushed the feat/add-make-sbom branch from a93e1f6 to 8db5499 Compare June 29, 2026 19:18

MarkAtwood assigned wolfSSL-Bot and unassigned MarkAtwood Jul 6, 2026

aidangarske requested changes Jul 9, 2026

View reviewed changes

Comment thread Makefile.am Outdated

Comment thread configure.ac Outdated

aidangarske assigned MarkAtwood and unassigned wolfSSL-Bot Jul 9, 2026

MarkAtwood assigned wolfSSL-Bot Jul 9, 2026

aidangarske requested changes Jul 10, 2026

View reviewed changes

Comment thread scripts/sbom.am Outdated

aidangarske unassigned wolfSSL-Bot Jul 10, 2026

dgarske requested changes Jul 10, 2026

View reviewed changes

dgarske assigned sameehj and wolfSSL-Bot Jul 10, 2026

sameehj force-pushed the feat/add-make-sbom branch from 4109012 to ecc3e2e Compare July 16, 2026 12:44

JacobBarthelmeh assigned dgarske and aidangarske and unassigned sameehj, wolfSSL-Bot and MarkAtwood Aug 12, 2026

dgarske previously approved these changes Aug 12, 2026

View reviewed changes

dgarske assigned ColtonWilley and unassigned dgarske Aug 12, 2026

dgarske requested review from ColtonWilley and aidangarske August 12, 2026 17:15

aidangarske requested changes Aug 12, 2026

View reviewed changes

Comment thread .github/workflows/sbom.yml Outdated

Comment thread .github/workflows/sbom.yml

Comment thread .github/workflows/sbom.yml Outdated

aidangarske assigned sameehj and unassigned ColtonWilley and aidangarske Aug 12, 2026

aidangarske removed the request for review from sameehj August 12, 2026 18:15

sameehj dismissed dgarske’s stale review via 4935f31 August 13, 2026 11:12

sameehj force-pushed the feat/add-make-sbom branch from ecc3e2e to 4935f31 Compare August 13, 2026 11:12

sameehj force-pushed the feat/add-make-sbom branch from 4b3fc71 to 0d54417 Compare August 13, 2026 12:48

aidangarske added the ci:sbom label Aug 13, 2026

aidangarske self-requested a review August 13, 2026 17:22

sameehj force-pushed the feat/add-make-sbom branch from e0f47ba to fd6f10b Compare August 14, 2026 12:12

aidangarske added ci:sbom and removed ci:sbom labels Aug 14, 2026

aidangarske added ci:sbom and removed ci:sbom labels Aug 24, 2026

aidangarske reviewed Aug 24, 2026

View reviewed changes

		* ML-DSA (FIPS 204): ML-DSA-44, ML-DSA-65, ML-DSA-87 (signatures, pure mode with empty context per FIPS 204 sec 5.2)


		## SBOM / EU CRA Compliance

Uh oh!

Conversation

MarkAtwood commented Jun 23, 2026

Summary

Usage

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aidangarske left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

MarkAtwood commented Jul 9, 2026

Uh oh!

MarkAtwood commented Jul 9, 2026

Detailed verification — both Skoll findings are against code that isn't in this PR

Finding 1 — "VERSION grep at Makefile.am:60 overrides Automake VERSION"

Finding 2 — "pyspdxtools probe never enforced by the sbom target"

Empirical — make sbom builds and passes on this exact SHA

Uh oh!

aidangarske left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Uh oh!

MarkAtwood commented Jul 10, 2026

Uh oh!

JacobBarthelmeh commented Aug 12, 2026

Uh oh!

aidangarske left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sameehj commented Aug 13, 2026

Uh oh!

aidangarske Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidangarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Skipped findings

Uh oh!

aidangarske Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Finding 1 — "VERSION grep at `Makefile.am:60` overrides Automake `VERSION`"

Empirical — `make sbom` builds and passes on this exact SHA

aidangarske Aug 24, 2026 •

edited

Loading