feat: add make sbom / install-sbom / uninstall-sbom targets by MarkAtwood · Pull Request #258 · wolfSSL/wolfCLU

MarkAtwood · 2026-06-23T22:35:16Z

Summary

Adds make sbom, make install-sbom, and make uninstall-sbom targets to wolfCLU's autotools build for EU CRA compliance evidence (CycloneDX 1.6 + SPDX 2.3 output)
Adds AC_CHECK_PROG checks for python3 and pyspdxtools in configure.ac

Usage

make sbom WOLFSSL_DIR=/path/to/wolfssl
# produces: wolfclu-0.2.0.cdx.json wolfclu-0.2.0.spdx.json wolfclu-0.2.0.spdx
pyspdxtools --infile wolfclu-0.2.0.spdx.json # must pass
make install-sbom # installs to $(datadir)/doc/wolfclu/
make uninstall-sbom

WOLFSSL_DIR must point to a wolfssl checkout containing scripts/gen-sbom (branch feat/sbom-embedded, or master once wolfSSL/wolfssl#10343 merges).

Notes

wolfCLU installs a binary (wolfssl), not a shared library — artifact hash uses --srcs $(wolfssl_SOURCES) (the compiled .c source list) rather than --lib; no staging step needed
Version read from CLUWOLFSSL_VERSION_STRING in wolfclu/version.h (the #define VERSION 0.3 in clu_header_main.h is stale and ignored)
WOLFSSL_INCLUDEDIR defaults to $(WOLFSSL_DIR)/include; wolfssl's options.h is used for the config source since wolfCLU has no generated options header of its own
uninstall-hook dependency ensures make uninstall removes SBOM files

Adds CycloneDX + SPDX SBOM generation via wolfssl's gen-sbom script. Usage: make sbom WOLFSSL_DIR=/path/to/wolfssl wolfCLU is a binary (not .so); artifact hash uses --srcs from wolfssl_SOURCES. Version from CLUWOLFSSL_VERSION_STRING in version.h.

Copilot

Pull request overview

Adds SBOM (CycloneDX + SPDX) generation and installation/uninstallation targets to the autotools build, along with configure-time discovery of required tooling, to support compliance/evidence needs.

Changes:

Adds make sbom, make install-sbom, make uninstall-sbom targets that generate SBOM artifacts and install/remove them under $(datadir)/doc/wolfclu/.
Introduces configure.ac checks for python3 and pyspdxtools intended to support the SBOM generation flow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
Makefile.am	Adds SBOM targets and wiring for generation + install/uninstall.
configure.ac	Adds configure-time tool detection for SBOM prerequisites.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

automake runs with -Werror; a second .PHONY (unconditional) overlapping the existing conditional .PHONY: manpages-gz triggered 'already defined' -> automake failed -> all CI configs red at autoreconf. Consolidate to one unconditional .PHONY covering manpages-gz + the sbom targets.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

jackctj117

Skoll Multi-Scan Review

Modes:review + review-securityOverall recommendation:COMMENT
Findings: 6 total — 6 posted, 0 skipped
6 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Medium] [review+review-security] SBOM build-options capture misses wolfCLU's config.h and AM_CFLAGS feature defines — scripts/sbom.am:129-131
[Medium] [review] PR description (--srcs / no staging) does not match implementation (--lib on staged binary) — scripts/sbom.am:106-183
[Low] [review] AC_PATH_PROG([PYTHON3]) duplicates AM_PATH_PYTHON and requires an executable literally named 'python3' — configure.ac:65
[Low] [review] Reproducibility CI step excludes the .spdx tag-value output from the byte-identical check — .github/workflows/sbom.yml:121-133
[Low] [review+review-security] pull_request branch filter '*' won't match base branches containing a slash — .github/workflows/sbom.yml:4-7
[Info] [review-security] CI builds and executes code from an unmerged external PR ref by default — .github/workflows/sbom.yml:40-59

Review generated by Skoll

Sync scripts/sbom.am with the canonical wolfSSL copy (capture AM_CFLAGS/CFLAGS, overridable SBOM_CONFIG_H, $(docdir) sbomdir, [[:space:]] version parse, GNU-make/uninstall docs), set SBOM_CONFIG_H=src/config.h and ship the fragment via EXTRA_DIST so the wolfCLU feature macros land in the SBOM, fall back to $PYTHON when python3 is absent, include the .spdx tag-value in the reproducibility check, and widen the workflow pull_request filter to '**'. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

Sync scripts/sbom.am with the unified canonical copy in wolfSSL (scripts/sbom.am), which adds the SBOM_OPTIONS_H override unifying options.h- and config.h/AM_CFLAGS-based macro capture into one fragment. wolfCLU keeps its subdir config.h override (SBOM_CONFIG_H = $(abs_builddir)/src/config.h) and does not set SBOM_OPTIONS_H, so the compiler + config.h path is unchanged; no behavior change. Keeps the vendored fragment byte-identical to the canonical. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

dgarske

Please resolve merge conflicts

dgarske · 2026-08-07T01:28:13Z

+ if: steps.gate.outputs.have == 'yes'
+ working-directory: wolfclu
+ run: |
+ autoreconf -ivf


Why not the 'autogen.sh script?

JacobBarthelmeh · 2026-08-12T17:07:26Z

Un-assigning wolfSSL-bot, needs rebased and review comments addressed.

CopilotAI review requested due to automatic review settings June 23, 2026 22:35

Copilotstarted reviewing on behalf of MarkAtwood June 23, 2026 22:35 View session

MarkAtwood requested a review from sameehj June 23, 2026 22:36

CopilotAI reviewed Jun 23, 2026
View reviewed changes

Comment threadMakefile.am Outdated
Comment threadMakefile.am Outdated
Comment threadconfigure.ac Outdated

cconlon assigned MarkAtwood Jun 23, 2026

MarkAtwood added 2 commits June 23, 2026 17:40

docs: add SBOM/EU CRA Compliance section to README
7a24607

MarkAtwood assigned wolfSSL-Bot and unassigned MarkAtwood Jul 7, 2026

sameehjand others added 2 commits July 9, 2026 09:55

sbom: adopt shared scripts/sbom.am fragment
6fd9382
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

sbom: add SBOM generation CI workflow
cdac833
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

jackctj117 self-requested a review July 10, 2026 16:43

jackctj117 reviewed Jul 10, 2026
View reviewed changes

Comment threadscripts/sbom.am Outdated
Comment threadscripts/sbom.am
Comment threadconfigure.ac Outdated
Comment thread.github/workflows/sbom.yml
Comment thread.github/workflows/sbom.yml
Comment thread.github/workflows/sbom.yml

jackctj117 requested a review from JacobBarthelmeh July 10, 2026 21:49

sameehj added 2 commits July 14, 2026 13:26

dgarske self-requested a review August 6, 2026 22:43

dgarske requested changes Aug 7, 2026
View reviewed changes

dgarske assigned sameehj and MarkAtwood Aug 7, 2026

JacobBarthelmeh unassigned wolfSSL-Bot Aug 12, 2026

Navigation Menu

Uh oh!

feat: add make sbom / install-sbom / uninstall-sbom targets - #258

feat: add make sbom / install-sbom / uninstall-sbom targets#258
MarkAtwood wants to merge 7 commits into
wolfSSL:mainfrom
MarkAtwood:feat/add-make-sbom

MarkAtwood commented Jun 23, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jackctj117 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Uh oh!

dgarskeAug 7, 2026

Uh oh!

JacobBarthelmeh commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

MarkAtwood commented Jun 23, 2026

Summary

Usage

Notes

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jackctj117 left a comment

Choose a reason for hiding this comment

Skoll Multi-Scan Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Uh oh!

dgarskeAug 7, 2026

Choose a reason for hiding this comment

Uh oh!

JacobBarthelmeh commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants