fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config

.github/workflows/sbom.yml

@@ -9,8 +9,7 @@ on:
     inputs:
       wolfssl_ref:
         description: 'wolfssl git ref that provides scripts/gen-sbom'
-        # TODO: switch back to 'master' once wolfSSL/wolfssl#10343 merges.
-        default: 'refs/pull/10343/head'
+        default: 'master'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -36,15 +35,13 @@ jobs:
       # built + installed here so wolfTPM has a library to link, and the same
       # source tree (scripts/gen-sbom + wolfssl/version.h) is passed to
       # `make sbom` via WOLFSSL_DIR -- so the recorded wolfSSL dependency
-      # version matches the linked one.  gen-sbom is not yet on wolfssl master,
-      # so default to the open PR head that carries it (wolfSSL/wolfssl#10343)
-      # so CI actually exercises `make sbom` instead of silently skipping.
-      # TODO: switch the fallback back to 'master' once #10343 merges.
+      # version matches the linked one.  gen-sbom landed on wolfssl master in
+      # wolfSSL/wolfssl#10343, so CI tracks master.
       - name: Checkout wolfssl (gen-sbom + library source)
         uses: actions/checkout@v4
         with:
           repository: wolfSSL/wolfssl
-          ref: ${{ github.event.inputs.wolfssl_ref || 'refs/pull/10343/head' }}
+          ref: ${{ github.event.inputs.wolfssl_ref || 'master' }}
           path: wolfssl
 
       - name: Install build tooling and SBOM validator (pyspdxtools)

README.md

@@ -1243,8 +1243,8 @@ make sbom WOLFSSL_DIR=/path/to/wolfssl
 ```
 
 Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). `WOLFSSL_DIR`
-must point to a wolfssl source tree containing `scripts/gen-sbom` (branch
-`feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges).
+must point to a wolfssl source tree containing `scripts/gen-sbom` (on `master`
+since wolfSSL/wolfssl#10343). This is a source checkout, not an install prefix.
 
 Output: `wolftpm-<version>.cdx.json`, `wolftpm-<version>.spdx.json`, `wolftpm-<version>.spdx`
 
@@ -1265,9 +1265,10 @@ make uninstall-sbom
 ```
 
 Note: recording wolfSSL as a dependency and emitting wolfTPM-specific project
-URLs require the `gen-sbom` from wolfSSL/wolfssl#10343. Against an older
-`gen-sbom`, `make sbom` still succeeds and produces a valid SBOM, but omits the
-wolfSSL dependency entry and inherits wolfSSL's project URLs.
+URLs require the `gen-sbom` added in wolfSSL/wolfssl#10343 and present on
+wolfssl master. Against an older `gen-sbom`, `make sbom` still succeeds and
+produces a valid SBOM, but omits the wolfSSL dependency entry and inherits
+wolfSSL's project URLs.
 
 For further CRA guidance see [wolfssl/doc/CRA.md](https://github.com/wolfSSL/wolfssl/blob/master/doc/CRA.md).
 

scripts/sbom.am

@@ -35,8 +35,13 @@
 #                       detected from SBOM_LICENSE_FILE.
 #   SBOM_LICENSE_TEXT   Path to licence text for any LicenseRef-* used in
 #                       SBOM_LICENSE_OVERRIDE (required by SPDX 2.3).
-#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency;
-#                       auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset.
+#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency.  When
+#                       unset and WOLFSSL_DIR is set it is read from that tree:
+#                       wolfssl/version.h, else configure.ac (version.h is
+#                       generated, so 'make distclean' removes it).  If neither
+#                       is readable the build fails rather than letting gen-sbom
+#                       fall back to pkg-config, which describes the installed
+#                       wolfSSL rather than the tree at WOLFSSL_DIR.
 #   SBOM_OPENSSL_VERSION   Version recorded for the OpenSSL dependency;
 #                       gen-sbom resolves it via pkg-config when unset.
 #
@@ -150,19 +155,34 @@ sbom:
 	        | $(GREP) -q -- '--dep-wolfssl'; then \
 	        dep_args="$$dep_args --dep-wolfssl yes"; \
 	        wv="$(SBOM_WOLFSSL_VERSION)"; \
-	        if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
-	            wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \
-	                "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	        if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \
+	            if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
+	                wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[ \t]*"\([^"]*\)".*/\1/p' \
+	                    "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	            fi; \
+	            if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \
+	                wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \
+	                    "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \
+	            fi; \
+	            if test -z "$$wv"; then \
+	                echo "ERROR: cannot determine the wolfSSL version from"; \
+	                echo "       $(WOLFSSL_DIR)"; \
+	                echo "       Neither wolfssl/version.h (generated by configure, so"; \
+	                echo "       'make distclean' removes it) nor configure.ac was"; \
+	                echo "       readable. Refusing to fall back to pkg-config: that"; \
+	                echo "       reports the *installed* wolfSSL, which may be a"; \
+	                echo "       different build than WOLFSSL_DIR, and would record a"; \
+	                echo "       wrong version in the SBOM. Re-run configure in that"; \
+	                echo "       tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \
+	                exit 1; \
+	            fi; \
 	        fi; \
 	        if test -n "$$wv"; then \
 	            dep_args="$$dep_args --dep-version wolfssl=$$wv"; \
 	        fi; \
 	    else \
 	        echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \
-	        echo "      will not list wolfssl as a dependency component. That"; \
-	        echo "      support is added by wolfSSL/wolfssl#10343; until it merges"; \
-	        echo "      to wolfssl master, point WOLFSSL_DIR at that PR's branch"; \
-	        echo "      to enable it. The generated SBOM is valid either way."; \
+	        echo "      will not list wolfssl as a dependency component."; \
 	    fi; \
 	fi; \
 	if test "$(SBOM_DEP_OPENSSL)" = yes; then \