fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config - #585
Open
MarkAtwood wants to merge 2 commits into
Open
fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config#585MarkAtwood wants to merge 2 commits into
MarkAtwood wants to merge 2 commits into
Conversation
wolfssl/version.h is generated by configure as well as tracked, so `make distclean` removes it. With it gone the --dep-version override was never passed and gen-sbom fell back to pkg-config, recording the installed wolfSSL's version rather than the tree at WOLFSSL_DIR. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, and fail when a named tree yields neither source. With no WOLFSSL_DIR the pkg-config lookup remains the intended source.
The SBOM workflow still checked out wolfssl at refs/pull/10343/head. That PR merged 2026-07-27, and GitHub keeps PR refs alive after merge, so CI stayed green while validating a pre-merge snapshot rather than master. Point wolfssl_ref and its fallback at master. Also drop the stale pre-merge guidance from the recipe NOTE (converging on the canonical wolfGlass wording) and from the README, both of which told users to track that PR's branch until it merged.
There was a problem hiding this comment.
Pull request overview
This PR updates the SBOM generation integration to ensure the wolfSSL dependency version is sourced from the WOLFSSL_DIR source tree (rather than potentially mismatching an installed wolfSSL via pkg-config), and updates docs/CI to track the now-merged upstream gen-sbom support.
Changes:
- Update
scripts/sbom.amto derive wolfSSL version fromWOLFSSL_DIR(wolfssl/version.h, falling back toconfigure.ac), and fail whenWOLFSSL_DIRis set but neither source can provide a version. - Update
README.mdSBOM guidance to reflectgen-sbomavailability on wolfSSLmaster. - Update SBOM CI workflow defaults to track wolfSSL
masternow that wolfSSL/wolfssl#10343 has landed.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| scripts/sbom.am | Reads wolfSSL version from the WOLFSSL_DIR tree (with a distclean-safe fallback) and refuses pkg-config fallback when that would misreport the dependency version. |
| README.md | Updates SBOM documentation to reflect upstream gen-sbom availability on wolfSSL master. |
| .github/workflows/sbom.yml | Updates CI defaults to checkout wolfSSL master for SBOM generation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
1245
to
+1247
| Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). `WOLFSSL_DIR` | ||
| must point to a wolfssl source tree containing `scripts/gen-sbom` (branch | ||
| `feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges). | ||
| must point to a wolfssl source tree containing `scripts/gen-sbom` (on `master` | ||
| since wolfSSL/wolfssl#10343). This is a source checkout, not an install prefix. |
Comment on lines
+158
to
+166
| if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \ | ||
| if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ | ||
| wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \ | ||
| "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ | ||
| fi; \ | ||
| if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ | ||
| wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ | ||
| "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ | ||
| fi; \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the fix from wolfSSL/wolfGlass#26 into this repo's vendored
scripts/sbom.am. Rationale, reproduction and verification are in that PR: wolfSSL/wolfGlass#26Verified against this copy on all five paths:
version.hpresent, distclean-ed tree (configure.acfallback), neither source (fails instead of guessing), noWOLFSSL_DIR(unchanged), and explicitSBOM_WOLFSSL_VERSION. The[ \t]sed form already in this file is preserved.