Skip to content

fix(deps): reject --dep-* values outside yes/no - #23

Merged
MarkAtwood merged 1 commit into
masterfrom
fix/dep-flag-validation
Aug 13, 2026
Merged

fix(deps): reject --dep-* values outside yes/no#23
MarkAtwood merged 1 commit into
masterfrom
fix/dep-flag-validation

Conversation

@MarkAtwood

Copy link
Copy Markdown
Contributor

Re-implementation of the valid idea from #12's sibling #17, against the flag set that exists on master today. #17 is closed because its diff reverted the parameterized wolfglass_sbom_rule macro, dropped --dep-wolfcrypt, and reintroduced --dep-liboqs which 6b15108 removed.

Problem

enabled_deps used if flag.lower() == 'yes', so every value that is not exactly yes was treated as no. A build fragment wiring --dep-wolfssl=\$(HAVE_WOLFSSL) where the variable expands to 1, true, on or Y dropped a CVE-bearing component from the SBOM with no diagnostic and exit 0.

Change

_enabled_deps() accepts only yes or no (case-insensitive, surrounding space tolerated) and exits with a message naming the flag and the dependency otherwise.

Test plan

  • python -m unittest tests/test_gen_sbom.py (201 tests, OK), including a subTest over 1, true, on, Y, enabled and the empty string
  • python tests/test_sbom.py (all checks passed; this drives the real generator end to end)

CopilotAI lite review requested due to automatic review settings August 13, 2026 01:31

CopilotAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens share/gen-sbom dependency-flag handling so --dep-* values must be exactly yes or no (case-insensitive, whitespace-tolerant), preventing silent omission of dependencies in generated SBOMs.

Changes:

  • Add _enabled_deps() helper to validate --dep-* inputs and sys.exit on invalid values.
  • Switch main() to use _enabled_deps() instead of flag.lower() == 'yes'.
  • Add unit tests covering valid/invalid --dep-* values and normalization behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

FileDescription
share/gen-sbomIntroduces strict validation for --dep-* values and wires it into dependency enabling.
tests/test_gen_sbom.pyAdds unit tests to verify the new validation and normalization behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines 2981 to +2986
if __name__ == '__main__':
unittest.main(verbosity=2)


class TestEnabledDepsValidation(unittest.TestCase):
"""--dep-* must be exactly yes or no.
@MarkAtwood
MarkAtwoodforce-pushed the fix/dep-flag-validation branch from 914e7b4 to 936277bCompareAugust 13, 2026 01:34
@MarkAtwood
MarkAtwood merged commit 62be065 into masterAug 13, 2026
1 check passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@MarkAtwood