feat: add make sbom / install-sbom / uninstall-sbom targets

[MarkAtwood]

Summary

• Adds make sbom, make install-sbom, and make uninstall-sbom targets to wolfProvider's autotools build for EU CRA compliance evidence (CycloneDX 1.6 + SPDX 2.3 output)
• Adds AC_CHECK_PROG checks for python3 and pyspdxtools in configure.ac

Usage

make sbom WOLFSSL_DIR=/path/to/wolfssl
# produces: wolfprov-1.1.1.cdx.json wolfprov-1.1.1.spdx.json wolfprov-1.1.1.spdx
pyspdxtools --infile wolfprov-1.1.1.spdx.json # must pass
make install-sbom # installs to $(datadir)/doc/wolfprov/
make uninstall-sbom

WOLFSSL_DIR must point to a wolfssl checkout containing scripts/gen-sbom (branch feat/sbom-embedded, or master once wolfSSL/wolfssl#10343 merges).

Notes

• Product name is wolfprov throughout (matches AC_INIT and lib_LTLIBRARIES), not wolfprovider
• No generated options.h; uses installed wolfssl's options.h via $(WOLFSSL_INCLUDEDIR)/wolfssl/options.h. WOLFSSL_DIR defaults to $(WOLFSSL_INSTALL_DIR) (set by --with-wolfssl= at configure time)
• wolfProvider's libtool default SONAME is libwolfprov.so.0.0.0 (no -version-info set) — --lib path uses this literal, not the package version 1.1.1
• Known limitation: if wolfssl was found via pkg-config rather than --with-wolfssl, WOLFSSL_INSTALL_DIR may be malformed; pass WOLFSSL_DIR= explicitly in that case

[Copilot]

Pull request overview

Adds SBOM generation and install/uninstall targets to the autotools build so wolfProvider can emit CycloneDX 1.6 and SPDX 2.3 artifacts (via wolfSSL’s gen-sbom script), plus configure-time discovery of required tooling.

Changes:

• Add make sbom, make install-sbom, and make uninstall-sbom targets that stage-install the built artifacts and generate CycloneDX/SPDX outputs.
• Add AC_CHECK_PROG checks for python3 and pyspdxtools in configure.ac.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
Makefile.am	Adds SBOM generation and install/uninstall targets and related variables.
configure.ac	Adds checks for python3 and pyspdxtools availability.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aidangarske]

🐺 Skoll Code Review

Overall recommendation:REQUEST_CHANGES
Findings: 2 total — 2 posted, 0 skipped

Posted findings

• [High] SBOM version lookup breaks clean out-of-tree builds and overrides Automake VERSION — Makefile.am:60-71
• [Medium] pyspdxtools probe is never enforced by the sbom target — configure.ac:30, Makefile.am:80-83

Review generated by Skoll.

[MarkAtwood]

Both Skoll findings are against code that isn't in this PR (verified against the current head):

• "VERSION grep at Makefile.am:60" — line 60 is a comment. There is no VERSION = assignment and no include/wolfprovider/version.h grep anywhere in the diff. SBOM filenames use $(PACKAGE_VERSION) (see scripts/sbom.am), so the "empty version / overrides Automake VERSION" symptom can't occur. The only version.h reads in the PR are the gated wolfSSL dependency version, a separate variable.

• "pyspdxtools probe never enforced" — the recipe enforces it before gen-sbom runs: scripts/sbom.am:95 has @test -n "$(PYSPDXTOOLS)" || { echo "ERROR: 'pyspdxtools' not found ..."; exit 1; }.

The recipe was refactored into the shared scripts/sbom.am (byte-identical to the wolfssh copy); the flagged lines predate that refactor. CI is green. Requesting a re-review / dismissal of the stale change-request.

[MarkAtwood]

Detailed verification — both Skoll findings are against code that isn't in this PR

Checked two ways against the reviewed head 611ccd038f14663e74e8225eb8fe821ff8290293: statically on a fresh clone, and empirically via this PR's own make sbom CI. Neither finding reproduces.

Finding 1 — "VERSION grep at Makefile.am:60 overrides Automake VERSION"

• No VERSION = … assignment exists in any Makefile.am, *.am, or configure.ac. grep -rnE '^[[:space:]]*VERSION[[:space:]]*[:]?=' over a clean clone of the head returns nothing.

• The only references to include/wolfprovider/version.h are benign: configure.ac:211 (an AC_CONFIG_FILES output generated from version.h.in) and include/include.am:7 (header install). Neither greps a version for the SBOM.

• SBOM output names use $(PACKAGE_VERSION), not$(VERSION):

  • scripts/sbom.am:52-54 — SBOM_CDX = $(SBOM_PKGNAME)-$(PACKAGE_VERSION).cdx.json (and .spdx.json, .spdx)
  • scripts/sbom.am:172 — gen-sbom is passed --version $(PACKAGE_VERSION)

  PACKAGE_VERSION is set by AC_INIT, so it cannot be empty — the wolfprov-.spdx symptom described in the finding cannot occur.

• Makefile.am:60 is a comment line (# … make sbom WOLFSSL_DIR=/path/to/wolfssl.), not a VERSION assignment.

Finding 2 — "pyspdxtools probe never enforced by the sbom target"

• It is enforced before the generator runs: scripts/sbom.am:95 — @test -n "$(PYSPDXTOOLS)" || { echo "ERROR: 'pyspdxtools' not found (pip install spdx-tools)."; exit 1; }
• And it is used: scripts/sbom.am:182 — $(PYSPDXTOOLS) --infile $(SBOM_SPDX) --outfile $(SBOM_SPDX_TV) (SPDX → tag-value).

Empirical — make sbom builds and passes on this exact SHA

The SBOM Test workflow (run https://github.com/wolfSSL/wolfProvider/actions/runs/29008558830) built the full openssl + wolfssl + wolfprovider stack from source and ran make sbom on 611ccd038. Every step passed, including:

• Generate SBOM — make sbom ran end-to-end
• Outputs exist and SPDX validates — pyspdxtools --infile validated the generated SPDX
• CycloneDX identity and licence — asserts a versioned purl (pkg:github/wolfSSL/wolfprovider@…) and GPL-3.0-or-later
• Reproducible across two runs, wolfssl / openssl recorded as dependencies

If the version were empty or pyspdxtools weren't wired, those steps would fail — they pass.

Both findings are incorrect against the current head. CI is green; requesting the change-request be dismissed so this can proceed.

[aidangarske]

🐺 Skoll Code Review

Overall recommendation:REQUEST_CHANGES
Findings: 2 total — 2 posted, 0 skipped

Posted findings

• [High] SBOM option capture omits configured compiler defines — scripts/sbom.am:129-131
• [Low] SBOM workflow executes mutable external gen-sbom ref — .github/workflows/sbom.yml:42-47

Review generated by Skoll.

[dgarske]

@sameehj or @MarkAtwood please see feedback #410 (review)

[MarkAtwood]

On the second finding (mutable gen-sbom ref in the workflow): pinned. The Checkout wolfssl (gen-sbom source) step and the workflow_dispatch default now fetch the immutable commit SHA 0a32b47b962aa626820f3cc2af5ee32ab348924a (current head of wolfSSL/wolfssl#10343) instead of refs/pull/10343/head, so a force-push can't silently change the gen-sbom CI runs. A TODO notes this moves to the wolfssl release/master copy once #10343 merges.

[JacobBarthelmeh]

Retest this please Jenkins. @aidangarske , @dgarske it looks like the review comments got marked as resolved. Can you re-review?

[aidangarske]

CI needs some work thanks

[sameehj]

Addressed the 12 Aug review (#410 (review)):

• Rebased onto current wolfSSL/wolfProvider master.
• Vendored wolfGlass into tools/sbom/ (pin d34a906, 0.1.0-draft). make sbom no longer needs a wolfSSL source tree for gen-sbom.
• Full SBOM CI is no longer on every PR. It runs on the nightly suite and on PRs labeled ci:sbom. The linked wolfSSL is built from master.

A per-PR make sbom smoke is not cheaper here: wolfProvider cannot configure without a built OpenSSL + wolfSSL stack, which is the expensive part of the full job.