feat: add sbom Makefile target#414
Conversation
Adds sbom target that calls gen-sbom to produce CycloneDX and SPDX output files. Parses version from ChangeLog.md. Sources enumerated from src/*.c. Requires WOLFSSL_DIR pointing to wolfssl tree with the feat/sbom-embedded branch (includes gen-sbom).
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds a make sbom target to generate CycloneDX and SPDX SBOM artifacts for wolfHSM using wolfSSL’s scripts/gen-sbom.
Changes:
- Introduces an
sbomMakefile target with checks for version parsing andWOLFSSL_DIR. - Gathers sources from
src/*.cand passes compiler defines + metadata intogen-sbom. - Emits versioned
wolfhsm-<version>.cdx.jsonandwolfhsm-<version>.spdx.jsonoutputs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # ---- SBOM generation ---- | ||
| CC ?= cc | ||
| WOLFSSL_DIR ?= ../../wolfssl | ||
| VERSION := $(shell sed -n 's/^# wolfHSM Release v\([0-9][0-9.]*\).*/\1/p' ChangeLog.md | head -1) |
| CC ?= cc | ||
| WOLFSSL_DIR ?= ../../wolfssl | ||
| VERSION := $(shell sed -n 's/^# wolfHSM Release v\([0-9][0-9.]*\).*/\1/p' ChangeLog.md | head -1) | ||
| SRCS := $(wildcard src/*.c) |
| --supplier "wolfSSL Inc." \ | ||
| --license-file LICENSING \ | ||
| --options-h "$$_defines" \ | ||
| --srcs $(SRCS) \ |
| _py=$$(command -v python3 2>/dev/null || command -v python 2>/dev/null) && \ | ||
| [ -n "$$_py" ] || { echo "ERROR: python3 not found." >&2; exit 1; } && \ | ||
| "$$_py" $(WOLFSSL_DIR)/scripts/gen-sbom \ |
| @_defines=$$(mktemp /tmp/wolfhsm-defines.XXXXXX) && \ | ||
| trap 'rm -f "$$_defines"' EXIT && \ |
There was a problem hiding this comment.
Running make sbom WOLFSSL_DIR=../wolfssl against the latest wolfSSL master I get the following error:
ERROR: ../wolfssl/scripts/gen-sbom not found.
Use a wolfSSL tree that includes SBOM support.
make: *** [Makefile:73: sbom] Error 1
Did this not merge into wolfSSL master yet? If so it shouldn't merge into wolfHSM.
| wolfHSM uses a custom build system; invoke `gen-sbom` from the wolfssl source | ||
| tree directly: | ||
|
|
||
| ```sh | ||
| python3 $WOLFSSL_DIR/scripts/gen-sbom \ | ||
| --name wolfhsm \ | ||
| --version $(head -1 $WOLFHSM_DIR/ChangeLog.md | grep -oE '[0-9]+\.[0-9]+\.[0-9]+') \ | ||
| --supplier "wolfSSL Inc." \ | ||
| --options-h $WOLFSSL_DIR/include/wolfssl/options.h \ | ||
| --srcs $WOLFHSM_DIR/src/*.c | ||
| ``` | ||
|
|
||
| `WOLFSSL_DIR` must point to a wolfssl source tree containing `scripts/gen-sbom` | ||
| (branch `feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges). | ||
| `WOLFHSM_DIR` is the root of the wolfHSM source tree. | ||
|
|
||
| Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). |
There was a problem hiding this comment.
this doc snippet looks outdated based on the changes in this PR, shouldn't we just recommend the end user run the new makefile target?
Summary
Adds a
make sbomtarget that produces CycloneDX and SPDX SBOM files for wolfHSM.ChangeLog.md(e.g.,# wolfHSM Release v1.4.0)src/*.c(sorted)gen-sbomto produce CDX + SPDX outputsUsage
```sh
make sbom WOLFSSL_DIR=/path/to/wolfssl/source
```
Outputs:
wolfhsm-<version>.cdx.json,wolfhsm-<version>.spdx.jsonRequirements
WOLFSSL_DIRmust point to a wolfssl source tree containingscripts/gen-sbom(available on thefeat/sbom-embeddedbranch of wolfssl)python3andpip install spdx-toolson the build hostTest plan
make sbom WOLFSSL_DIR=...