Repository navigation
feat: add make sbom / install-sbom / uninstall-sbom targets - #227
Open
MarkAtwood wants to merge 5 commits into
Open
MarkAtwood wants to merge 5 commits into
MarkAtwood wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds SBOM generation + install/uninstall targets to the autotools build to produce CycloneDX 1.6 and SPDX 2.3 outputs (via wolfSSL’s scripts/gen-sbom), and wires tool detection into configure.ac.
Changes:
- Adds
make sbom,make install-sbom, andmake uninstall-sbomtargets (plus uninstall hook integration). - Introduces configure-time detection for SBOM-related tools (
python3,pyspdxtools).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| Makefile.am | Adds SBOM build/install/uninstall targets and staging logic for SBOM generation artifacts. |
| configure.ac | Adds AC_CHECK_PROG checks for SBOM-related tools. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
sameehj
force-pushed
the
feat/add-make-sbom
branch
from
July 10, 2026 09:50
88495c6 to
ce3c236
Compare
rlm2002
reviewed
Jul 10, 2026
rlm2002
left a comment
rlm2002
left a comment
There was a problem hiding this comment.
Skoll Code Review
Scan type: reviewOverall recommendation: REQUEST_CHANGES
Findings: 5 total — 3 posted, 2 skipped
3 finding(s) posted as inline comments (see file-level comments below)
Posted findings
- [High] SBOM build-options capture omits AM_CFLAGS, where all wolfEngine feature macros live —
scripts/sbom.am:131-133 - [Medium] config.h fallback path never matches wolfEngine's include/config.h —
scripts/sbom.am:132 - [Low] PR trigger 'branches: [*]' does not match slashed base branches —
.github/workflows/sbom.yml:8-9
Skipped findings
- [Low]
SBOM 'records the configured build options' claim is inaccurate as implemented - [Info]
install-sbom is opt-in but uninstall-sbom is hooked into uninstall (minor asymmetry)
Review generated by Skoll
jackctj117
approved these changes
Jul 23, 2026
Adds CycloneDX + SPDX SBOM generation via wolfssl's gen-sbom script. Usage: make sbom WOLFSSL_DIR=/path/to/wolfssl wolfEngine has no generated options.h; uses installed wolfssl's options.h (via WOLFSSL_INCLUDEDIR, defaults to WOLFSSL_DIR/include). Library SONAME discovered dynamically from staged install since libtool version-info 1:4:0 produces libwolfengine.so.1.0.4.
Replace the inline SBOM recipe with the shared, product-agnostic scripts/sbom.am used across the wolfSSL autotools stack. wolfEngine just declares what it is (a libwolfengine shared library that links both wolfSSL and OpenSSL) and includes the fragment, gaining reproducible output, license/version pinning, SPDX validation, dependency recording (wolfssl + openssl), and an install/uninstall hook. Switch configure to AC_PATH_PROG + AC_SUBST, expand the README, and add a SBOM CI workflow. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Sync scripts/sbom.am with the canonical wolfSSL copy (capture AM_CFLAGS/CFLAGS, overridable SBOM_CONFIG_H, $(docdir) sbomdir, [[:space:]] version parse, GNU-make/uninstall docs), set SBOM_CONFIG_H=include/config.h and ship the fragment via EXTRA_DIST so the WE_* feature macros land in the SBOM, and widen the workflow pull_request filter to '**'. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Sync scripts/sbom.am with the unified canonical copy in wolfSSL (scripts/sbom.am), which adds the SBOM_OPTIONS_H override so a single fragment supports both options.h- and config.h/AM_CFLAGS-based macro capture. wolfEngine keeps its config.h override (SBOM_CONFIG_H = $(abs_builddir)/include/config.h) and does not set SBOM_OPTIONS_H, so it continues to use the compiler + config.h path; no behavior change. Keeps the vendored fragment byte-identical to the canonical. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
MarkAtwood
force-pushed
the
feat/add-make-sbom
branch
from
July 23, 2026 17:15
0c790f2 to
ba5f41d
Compare
Author
|
@JacobBarthelmeh approved by jack back in august, green, can you merge? |
|
@MarkAtwood Isn't it better to migrate to wolfssl-compliance-tooling before merging?? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
make sbom,make install-sbom, andmake uninstall-sbomtargets to wolfEngine's autotools build for EU CRA compliance evidence (CycloneDX 1.6 + SPDX 2.3 output)AC_CHECK_PROGchecks forpython3andpyspdxtoolsinconfigure.acUsage
WOLFSSL_DIRmust point to a wolfssl checkout containingscripts/gen-sbom(branchfeat/sbom-embedded, ormasteronce wolfSSL/wolfssl#10343 merges).Notes
options.h; feature flags come from the installed wolfssl.--options-his read from$(WOLFSSL_INCLUDEDIR)/wolfssl/options.h(defaults to$(WOLFSSL_DIR)/include; override withmake sbom WOLFSSL_INCLUDEDIR=...if wolfssl headers live elsewhere)1:4:0produceslibwolfengine.so.1.0.4, notlibwolfengine.so.1.4.0— the staged.sois located withfindrather than a hardcoded version suffixuninstall-hookdependency ensuresmake uninstallremoves SBOM files