fix(deps): reject --dep-* values outside yes/no

Author: MarkAtwood

share/gen-sbom

@@ -1461,6 +1461,25 @@ def _inherit_wolfcrypt_version(enabled_deps, overrides, name, version):
     elif name.lower() == 'wolfssl':
         overrides['wolfcrypt'] = version
     return overrides
+def _enabled_deps(dep_flags):
+    """Return the enabled dependency keys, rejecting values outside {yes, no}.
+
+    Treating anything that is not 'yes' as 'no' loses a dependency silently.
+    A build fragment wiring `--dep-wolfssl=$(HAVE_WOLFSSL)` where the variable
+    expands to 1, true, on or Y would drop a CVE-bearing component from the
+    SBOM with no diagnostic, which is the one failure mode a CRA tool must
+    never have.  Fail loudly instead.
+    """
+    enabled = []
+    for key, flag_name, value in dep_flags:
+        normalized = (value or '').strip().lower()
+        if normalized not in ('yes', 'no'):
+            sys.exit(f"ERROR: {flag_name} expects 'yes' or 'no', got {value!r}. "
+                     f"A value outside that set would silently drop {key} from "
+                     f"the SBOM.")
+        if normalized == 'yes':
+            enabled.append(key)
+    return enabled
 
 
 def main():
@@ -1646,15 +1665,12 @@ def main():
                 "https://example.com/sbom/wolfssl-X.Y.Z.spdx.json or "
                 "urn:uuid:00000000-0000-0000-0000-000000000000.")
 
-    enabled_deps = [
-        key for key, flag in [
-            ('wolfssl',   args.dep_wolfssl),
-            ('wolfcrypt', args.dep_wolfcrypt),
-            ('openssl',   args.dep_openssl),
-            ('libz',      args.dep_libz),
-        ]
-        if flag.lower() == 'yes'
-    ]
+    enabled_deps = _enabled_deps([
+        ('wolfssl',   '--dep-wolfssl',   args.dep_wolfssl),
+        ('wolfcrypt', '--dep-wolfcrypt', args.dep_wolfcrypt),
+        ('openssl',   '--dep-openssl',   args.dep_openssl),
+        ('libz',      '--dep-libz',      args.dep_libz),
+    ])
     dep_version_overrides = _parse_dep_version_overrides(args.dep_version)
     # Resolve each enabled dependency's version once, here, and feed the
     # result to both the CDX and SPDX emitters via the overrides map (see

tests/test_gen_sbom.py

@@ -3028,3 +3028,38 @@ def test_inherited_version_yields_a_resolvable_cpe(self):
         self.assertEqual(
             comp['cpe'], 'cpe:2.3:a:wolfssl:wolfcrypt:5.9.1:*:*:*:*:*:*:*')
         self.assertEqual(len(comp['cpe'].split(':')), 13)
+class TestEnabledDepsValidation(unittest.TestCase):
+    """--dep-* must be exactly yes or no.
+
+    Anything else was previously treated as 'no', so a fragment wiring
+    --dep-wolfssl=$(HAVE_WOLFSSL) where the variable expands to 1/true/on/Y
+    dropped a CVE-bearing component with no diagnostic.
+    """
+
+    def test_yes_enables_and_no_disables(self):
+        self.assertEqual(
+            gs._enabled_deps([('wolfssl', '--dep-wolfssl', 'yes'),
+                              ('libz', '--dep-libz', 'no')]),
+            ['wolfssl'])
+
+    def test_case_and_surrounding_space_tolerated(self):
+        self.assertEqual(
+            gs._enabled_deps([('wolfssl', '--dep-wolfssl', ' YES ')]),
+            ['wolfssl'])
+
+    def test_truthy_lookalikes_are_rejected_not_silently_dropped(self):
+        for bogus in ('1', 'true', 'on', 'Y', 'enabled'):
+            with self.subTest(value=bogus):
+                with self.assertRaises(SystemExit):
+                    gs._enabled_deps([('wolfssl', '--dep-wolfssl', bogus)])
+
+    def test_empty_is_rejected(self):
+        with self.assertRaises(SystemExit):
+            gs._enabled_deps([('wolfssl', '--dep-wolfssl', '')])
+
+    def test_order_follows_declaration_not_input(self):
+        self.assertEqual(
+            gs._enabled_deps([('wolfssl', '--dep-wolfssl', 'yes'),
+                              ('wolfcrypt', '--dep-wolfcrypt', 'yes'),
+                              ('libz', '--dep-libz', 'yes')]),
+            ['wolfssl', 'wolfcrypt', 'libz'])