Repository navigation
Conversation
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old function and script names, so a re-sync alone breaks the CMake build. - Re-vendor tools/sbom/ at 8a96c64 and pin it in .wolfssl-compliance-tooling-rev. - Call wolfssl_compliance_tooling_add_sbom in CMakeLists.txt. - Add the new vendored files to EXTRA_DIST, so the release tarball has what the CMake helper needs. - Point the drift check at wolfSSL/wolfssl-compliance-tooling and rename the job to compliance_tooling_drift. - Use the new name in the docs, the Japanese docs, and comments. The CMake helper now also adds install-sbom and uninstall-sbom targets.
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved SBOM defects bypass validation and omit SPDX installation, break DESTDIR staging, and mishandle Zephyr sources, compiler launchers, and cross-drive inputs.
5 open issues
What changed in this PR
Migrates wolfTPM’s vendored SBOM tooling from wolfGlass to wolfssl-compliance-tooling, updating build integration, release packaging, and documentation for the renamed upstream project.
Changes:
- Pins the refreshed tooling to
8a96c64and updates the drift-check workflow. - Adopts the renamed CMake helper and adds SBOM installation, removal, and reproducible-timestamp support.
- Refreshes generation, validation, and source extraction across supported build systems.
| File | Description |
|---|---|
tools/sbom/validate_sbom.py |
Improves file and JSON validation errors. |
tools/sbom/sbom.am |
Adds artifact overrides and metadata options. |
tools/sbom/sbom-driver.py |
Updates input validation and generator options. |
tools/sbom/sbom-driver |
Renames tooling in the wrapper comment. |
tools/sbom/README.md |
Documents updated interfaces and installation targets. |
tools/sbom/gen-sbom |
Adds atomic writes and configurable copyright metadata. |
tools/sbom/frontends/zephyr_sbom.py |
Uses compilation databases for source and macro extraction. |
tools/sbom/frontends/included_sources.py |
Adds discovery of source files included through preprocessing. |
tools/sbom/frontends/iar_sbom.py |
Honors configuration-specific source exclusions. |
tools/sbom/frontends/compdb_sbom.py |
Adds source filtering, macro conflict checks, and included-source scanning. |
tools/sbom/build/uninstall-sbom.cmake |
Removes installed SBOM artifacts. |
tools/sbom/build/sbom.mk |
Renames the Make macro and forwards new options. |
tools/sbom/build/sbom.cmake |
Updates the helper and adds installation targets. |
tools/sbom/build/sbom-with-sde.cmake |
Resolves reproducible timestamps at build time. |
tools/sbom/build/sbom-paths.cmake |
Resolves shared installation artifact paths. |
tools/sbom/build/install-sbom.cmake |
Installs SBOM artifacts with staging support. |
tools/sbom/.wolfssl-compliance-tooling-rev |
Pins the new upstream revision. |
tools/sbom/.wolfglass-rev |
Removes the old revision pin. |
Makefile.am |
Includes new vendored files in release archives. |
docs/sbom-and-compliance.md |
Updates tooling names and references. |
docs/ja/sbom-and-compliance.md |
Updates Japanese documentation references. |
CMakeLists.txt |
Calls the renamed SBOM helper. |
.github/workflows/sbom.yml |
Updates the drift-check repository, pin, and command. |
Review effort: Balanced
| continue | ||
| if root_abs: | ||
| real = os.path.realpath(fpath) | ||
| if os.path.commonpath([real, root_abs]) != root_abs: |
There was a problem hiding this comment.
This file is a vendored copy, so the fix is upstream: wolfSSL/wolfssl-compliance-tooling#54. A ValueError from commonpath() now means "outside --root", as in included_sources._scan(). When that PR merges, I will re-vendor tools/sbom/ and update the pin here.
| if (not out.startswith(lib_dir) | ||
| or not src.lower().endswith(SRC_EXTS)): | ||
| continue |
There was a problem hiding this comment.
This file is a vendored copy, so the fix is upstream: wolfSSL/wolfssl-compliance-tooling#54. It adds --target. For wolfTPM, zephyr_sbom.py --target app takes the objects of the app target under --root. The default selection does not change. When that PR merges, I will re-vendor tools/sbom/ and update the pin here.
| if not toks: | ||
| raise ParseError(f"empty compile command for {entry.get('file')}") | ||
| return toks |
There was a problem hiding this comment.
This file is a vendored copy, so the fix is upstream: wolfSSL/wolfssl-compliance-tooling#54. The frontend now strips ccache, sccache, distcc and icecc with the same _compiler_index() helper that included_sources.py uses. When that PR merges, I will re-vendor tools/sbom/ and update the pin here.
… staging - Pass TV_OUT and INSTALL_DEPENDS sbom. install-sbom then validates the SPDX, removes the staging tree, and installs the .spdx file. uninstall-sbom removes the same files. - Unset DESTDIR for the private staging install. Before, DESTDIR=/stage make install-sbom put the library under /stage/<build>/_sbom_staging, and the driver did not find it.
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old function and script names, so a re-sync alone breaks the CMake build.
The CMake helper now also adds install-sbom and uninstall-sbom targets.