fix(validate_sbom): do not require a CPE on nested wolfcrypt

Matching rides on the wolfssl CPE. wolfcrypt stays a provenance
component and must still carry a version and a PURL.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: sameehj

share/validate_sbom.py

@@ -13,8 +13,10 @@
     * at least one component or component property recorded
     * optional --min-properties N on metadata.component.properties
     * optional --require-dep-version NAME: a components[] entry with that
-      name must exist and carry a non-empty version and CPE. Nested
-      sub-components count, since wolfcrypt ships inside wolfssl.
+      name must exist and carry a non-empty version. Nested sub-components
+      count, since wolfcrypt ships inside wolfssl. wolfcrypt is provenance
+      only (PURL, no CPE); matching rides on the parent wolfssl CPE. Every
+      other required dep must also carry a CPE.
 
   SPDX (*.spdx.json):
     * spdxVersion starts with "SPDX-2"
@@ -34,6 +36,12 @@
 import sys
 
 
+# Nested wolfcrypt is a provenance component. NVD files crypto CVEs against
+# wolfssl, not wolfcrypt; requiring a wolfcrypt CPE would fail a correct
+# SBOM and would later double-match. The unique id is the PURL.
+_CPE_OPTIONAL_DEPS = frozenset({"wolfcrypt"})
+
+
 def fail(path, msg):
     print(f"FAIL [{path}]: {msg}", file=sys.stderr)
     sys.exit(1)
@@ -81,6 +89,11 @@ def validate_cyclonedx(path, d, name_prefix, min_properties, require_deps):
         if not matches[0].get("version"):
             fail(path, f"dependency component {dep_name!r} has no version "
                        f"(pass --dep-version or set WOLFSSL_DIR)")
+        if dep_name in _CPE_OPTIONAL_DEPS:
+            if not matches[0].get("purl"):
+                fail(path, f"dependency component {dep_name!r} has no purl "
+                           f"(provenance id; matching uses the wolfssl CPE)")
+            continue
         if not matches[0].get("cpe"):
             fail(path, f"dependency component {dep_name!r} has no cpe "
                        f"(CPE-driven scanners cannot match it)")

tests/test_sbom.py

@@ -176,6 +176,7 @@ def unit_tests():
                     "cpe": "cpe:2.3:a:wolfssl:wolfssl:5.9.1:*:*:*:*:*:*:*",
                     "components": [{
                         "name": "wolfcrypt", "version": "5.9.1",
+                        "purl": "pkg:github/wolfssl/wolfssl@v5.9.1-stable#wolfcrypt",
                     }],
                 }],
             }, f)
@@ -185,6 +186,44 @@ def unit_tests():
                              stdout=subprocess.DEVNULL)
         check(rc == 0, "validator finds a nested dependency component")
 
+        no_purl = os.path.join(d, "no-purl.cdx.json")
+        with open(no_purl, "w") as f:
+            json.dump({
+                "bomFormat": "CycloneDX", "specVersion": "1.6",
+                "metadata": {"component": {"name": "wolfboot",
+                                           "version": "2.9.0",
+                                           "properties": [{"a": "b"}]}},
+                "components": [{
+                    "name": "wolfssl", "version": "5.9.1",
+                    "cpe": "cpe:2.3:a:wolfssl:wolfssl:5.9.1:*:*:*:*:*:*:*",
+                    "components": [{
+                        "name": "wolfcrypt", "version": "5.9.1",
+                    }],
+                }],
+            }, f)
+        rc = subprocess.call([sys.executable, VALIDATE,
+                              "--require-dep-version", "wolfcrypt", no_purl],
+                             stdout=subprocess.DEVNULL,
+                             stderr=subprocess.DEVNULL)
+        check(rc != 0, "validator rejects nested wolfcrypt without a PURL")
+
+        no_cpe = os.path.join(d, "no-cpe.cdx.json")
+        with open(no_cpe, "w") as f:
+            json.dump({
+                "bomFormat": "CycloneDX", "specVersion": "1.6",
+                "metadata": {"component": {"name": "wolfboot",
+                                           "version": "2.9.0",
+                                           "properties": [{"a": "b"}]}},
+                "components": [{
+                    "name": "wolfssl", "version": "5.9.1",
+                }],
+            }, f)
+        rc = subprocess.call([sys.executable, VALIDATE,
+                              "--require-dep-version", "wolfssl", no_cpe],
+                             stdout=subprocess.DEVNULL,
+                             stderr=subprocess.DEVNULL)
+        check(rc != 0, "validator still requires a CPE on wolfssl")
+
 
 def find_gen_sbom(explicit):
     if explicit and os.path.isfile(explicit):