[sameehj]

What

Frauschi's review of wolfSSL/wolfssl#11701 found bugs in the CMake code that wolfSSL and wolfTPM write around wolfssl_compliance_tooling_add_sbom(). The code is generic, so the helper now does that work, and the products can remove their copies.

• STAGE_TARGET <t>: hash the installed copy of <t>, as make sbom does. When the target runs, the project is installed with DESTDIR into _sbom_staging in the build tree. The prefix stays the real one, so the staged file has the same bytes (RPATH, install name) as a real install. This fixes two bugs of cmake --install --prefix:

  • A DESTDIR in the environment moved the staged files, and the driver did not find the library. The staging now sets its own DESTDIR and restores the caller's after the install.
  • An absolute CMAKE_INSTALL_LIBDIR installed into the real directory. With DESTDIR, it stays inside the staging tree.

  The file is the target's file name in CMAKE_INSTALL_FULL_LIBDIR, or in CMAKE_INSTALL_FULL_BINDIR for a program or a Windows DLL. The staging directory is removed after the driver runs, also when it fails.

• VALIDATE: run pyspdxtools on the SPDX file and write the tag-value file (TV_OUT, or the SPDX path without .json) in the same target. install-sbom depends on that target, so it now validates the SPDX file and installs the .spdx file. Before, wolfSSL's install-sbom depended on the generation target only, so it skipped pyspdxtools and did not install the .spdx file.

• Missing tools: a missing python3, or a missing pyspdxtools with VALIDATE, no longer fails configure (-DCMAKE_DISABLE_FIND_PACKAGE_Python3=ON reproduced the failure). The target fails with the reason when someone builds it (sbom-fail.cmake).

• share/README.md: the title was # share/, and it pointed at a sync tool that a product does not have. It now names the toolkit, and it says that the sync tool is in a toolkit checkout. It also lists the CMake scripts and the new options.

Tests

New HelperBuildTests in tests/test_sbom_cmake_install.py. Each test builds a small shared library:

• test_stage_validate_and_install: absolute CMAKE_INSTALL_LIBDIR and DESTDIR set for install-sbom. The library is not installed to the absolute directory. No _sbom_staging stays. The CycloneDX, SPDX and tag-value files are installed under DESTDIR. The CycloneDX hash is the SHA-256 of a real installed copy.
• test_failed_validation_fails_the_target: a failed pyspdxtools fails install-sbom, writes no tag-value file and leaves no staging directory.
• test_staging_without_a_build_fails_and_cleans_up: a failed staging install gives a clear error and leaves no staging directory.
• test_missing_python_fails_at_build_time and test_validate_without_pyspdxtools_fails_at_build_time: configure succeeds, and the build fails with the reason.

The tests use a stub pyspdxtools, so CI does not need spdx-tools.

This branch merges cleanly with #51. #49 and #50 already conflict with master in share/build/sbom.mk (from #52). This PR does not change that file.

[Copilot]

🟡 Changes recommended

Shared staging directories can cause parallel SBOM targets to delete each other’s files, while conflicting checksum options and colliding validation paths can fail generation or delete generated output.

3 open issues

• Isolate staging directories for concurrent targets · New
• Reject colliding default SPDX and TV output paths · New
• Reject TARGETS when SB_LIB is set · New

What changed in this PR

This PR moves installed-artifact staging and SPDX validation into the shared CMake SBOM helper, reducing logic that products need to maintain themselves.

Changes:

• Adds STAGE_TARGET to hash installed artifacts using isolated DESTDIR staging.
• Adds VALIDATE and tag-value output installation, with missing-tool errors deferred until build time.
• Adds integration tests and updates vendoring documentation.

File	Description
tests/​test_sbom_cmake_install.py	Tests staging, validation, installation, cleanup, and missing tools.
share/​README.md	Clarifies vendoring instructions and documents new helper options.
share/​build/​sbom.cmake	Wires staging, validation, and build-time prerequisite failures.
share/​build/​sbom-with-sde.cmake	Stages installed artifacts and cleans up after generation.
share/​build/​sbom-validate.cmake	Validates SPDX and writes tag-value output.
share/​build/​sbom-paths.cmake	Derives the tag-value output path for validation.
share/​build/​sbom-fail.cmake	Reports missing prerequisites when the target runs.

_{Review effort: Balanced}

[Frauschi]

Reproduced: two STAGE_TARGET calls in one directory built with -j2 failed 5 of 15 runs with "SBOM staging install failed".

[Frauschi]

Reproduced: SPDX_OUT b.spdx with VALIDATE left b.spdx holding the tag-value output instead of the SPDX JSON.

[Frauschi]

Ran the new tests locally and the staging hashes the installed copy; three issues inline.

[Frauschi]

This conflicts with #51 in sbom.cmake. After the rebase, #51's python3 fallback has to run before the _sbom_error check, and the new sbom-fail, sbom-validate and sbom-with-sde -P paths (L390, L408, L414) need ${_sbom_dir}.