Repository navigation
Conversation
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old macro, function, and script names, so a re-sync alone breaks the build. - Re-vendor tools/sbom/ at 8a96c64 and pin it in .wolfssl-compliance-tooling-rev. - Call wolfssl_compliance_tooling_sbom_rule in the Makefile and wolfssl_compliance_tooling_add_sbom in cmake/sbom.cmake. - Point the drift check at wolfSSL/wolfssl-compliance-tooling and rename the job to compliance_tooling_drift. - Use the new name in the docs and comments. The CMake helper now also adds install-sbom and uninstall-sbom targets.
There was a problem hiding this comment.
🟡 Changes recommended
The changes break existing Zephyr CLI callers, require Python for unrelated CMake configurations, and fail to capture user settings in compiler-cached Zephyr builds.
3 open issues
What changed in this PR
Migrates wolfBoot’s vendored SBOM tooling from wolfGlass to wolfssl-compliance-tooling, pins revision 8a96c64, and updates build integration and drift checking.
Changes:
- Renames Make/CMake entry points, upstream references, and revision tracking.
- Imports updated generation, validation, and source-extraction tooling.
- Adds CMake SBOM install/uninstall targets and build-time reproducible timestamps.
| File | Description |
|---|---|
tools/scripts/wolfboot-sbom.sh |
Updates the wrapper comment. |
tools/scripts/ide-sbom/zephyr_sbom.py |
Updates the wrapper docstring. |
tools/scripts/ide-sbom/validate_sbom.py |
Updates the wrapper docstring. |
tools/scripts/ide-sbom/iar_sbom.py |
Updates the wrapper docstring. |
tools/scripts/ide-sbom/compdb_sbom.py |
Updates the wrapper docstring. |
tools/sbom/validate_sbom.py |
Improves input validation and read errors. |
tools/sbom/sbom.am |
Extends artifact, dependency, and metadata options. |
tools/sbom/sbom-driver.py |
Updates input contracts and generator options. |
tools/sbom/sbom-driver |
Updates the shell-wrapper comment. |
tools/sbom/README.md |
Documents renamed tooling and expanded interfaces. |
tools/sbom/gen-sbom |
Adds atomic output writes and configurable copyright metadata. |
tools/sbom/frontends/zephyr_sbom.py |
Switches to compilation-database source extraction. |
tools/sbom/frontends/included_sources.py |
Adds scanning for included source files. |
tools/sbom/frontends/iar_sbom.py |
Honors configuration-specific source exclusions. |
tools/sbom/frontends/compdb_sbom.py |
Adds source scanning, filtering, and macro-conflict checks. |
tools/sbom/build/uninstall-sbom.cmake |
Removes installed SBOM artifacts. |
tools/sbom/build/sbom.mk |
Renames the Make macro and expands supported options. |
tools/sbom/build/sbom.cmake |
Updates the helper and adds installation targets. |
tools/sbom/build/sbom-with-sde.cmake |
Applies reproducible timestamps at build time. |
tools/sbom/build/sbom-paths.cmake |
Resolves SBOM paths for installation and removal. |
tools/sbom/build/install-sbom.cmake |
Installs SBOM artifacts with staging support. |
tools/sbom/.wolfssl-compliance-tooling-rev |
Pins the new upstream revision. |
tools/sbom/.wolfglass-rev |
Removes the old revision pin. |
README.md |
Updates the tooling name in release notes. |
Makefile |
Calls the renamed HAL SBOM macro. |
docs/SBOM.md |
Updates tooling and drift-check references. |
cmake/sbom.cmake |
Calls the renamed CMake helper. |
.gitignore |
Updates the vendored-directory comment. |
.github/workflows/test-sbom.yml |
Retargets drift checking to the renamed repository. |
Review effort: Balanced
| if(NOT Python3_EXECUTABLE) | ||
| message(FATAL_ERROR | ||
| "wolfssl_compliance_tooling_add_sbom: python3 was not found") | ||
| endif() |
| ap.add_argument('--compdb', required=True, | ||
| help="The west build's compile_commands.json.") | ||
| ap.add_argument('--root', required=True, help='The module directory.') |
| f"{entry.get('file')}: {e}") | ||
| if not toks: | ||
| raise ParseError(f"empty compile command for {entry.get('file')}") | ||
| return toks |
Frauschi
left a comment
Frauschi
left a comment
There was a problem hiding this comment.
Copilot already covers the Zephyr --cmakelists break and the new python3 requirement at configure time, so I left those out. A few more below. Apart from the CI one they're all in the vendored tools/sbom/ files, so the fixes probably belong upstream in wolfssl-compliance-tooling, followed by a re-sync here.
| endif() | ||
|
|
||
| wolfglass_add_sbom(${_sbom_args}) | ||
| wolfssl_compliance_tooling_add_sbom(${_sbom_args}) |
There was a problem hiding this comment.
The new helper call also adds install-sbom and uninstall-sbom, but nothing in test-sbom.yml runs them. Could the CMake step run DESTDIR=$PWD/stage cmake --build build-sim --target install-sbom, check both documents land under the stage dir, then run uninstall-sbom and check they're gone?
| if args.lib or args.srcs_file: | ||
| sys.exit("ERROR: --no-artifact-hash stands alone. " | ||
| "Do not pass --lib or --srcs-file.") | ||
| elif args.lib and args.srcs_file: |
There was a problem hiding this comment.
The driver now rejects --lib together with --srcs-file, but sbom.mk only checks that SRCS/LIB aren't both empty, sbom.cmake only rejects NOT SB_TARGETS AND NOT SB_LIB, and tools/sbom/README.md still says "Composition (at least one)". Setting both passes configure and only fails once the sbom target runs.
wolfBoot passes only one, so it isn't hit here, but the fragments and README should enforce the same rule as the driver. Since these files are vendored, that's probably an upstream fix.
| list(APPEND _cmd --spdx-out ${SB_SPDX_OUT}) | ||
| endif() | ||
|
|
||
| # SOURCE_DATE_EPOCH is applied when the target runs. A value set only |
There was a problem hiding this comment.
With SOURCE_DATE_EPOCH unset, the CMake target now falls back to the last commit time via sbom-with-sde.cmake, but make sbom calls the driver directly and gen-sbom uses the current time. So the same checkout gets a different timestamp and copyright end-year depending on the build system. CI doesn't see it because the equivalence step exports SOURCE_DATE_EPOCH.
Doing the git fallback once in sbom-driver.py would cover Make, CMake and the Windows route the same way.
| else() | ||
| set(_destdir "") | ||
| endif() | ||
| set(_staged "${_destdir}${WOLFSSL_COMPLIANCE_TOOLING_INSTALL_DIR}") |
There was a problem hiding this comment.
On Windows, file(INSTALL) drops the drive letter from the destination before prepending DESTDIR, but _staged here (and _dest in uninstall-sbom.cmake) is a plain concatenation. With DESTDIR=D:/stage and an install dir of C:/Program Files/wolfboot, the files go to D:/stage/Program Files/wolfboot, while file(MAKE_DIRECTORY) and uninstall use D:/stageC:/Program Files/wolfboot.
Stripping a leading X: from the install dir when DESTDIR is set, in both scripts, would keep them consistent. The MAKE_DIRECTORY call isn't needed anyway, since file(INSTALL) creates the destination.
| cmd += ["--license-override", args.license_override] | ||
| if args.license_text: | ||
| cmd += ["--license-text", args.license_text] | ||
| if args.document_namespace and gen_sbom_supports( |
There was a problem hiding this comment.
gen_sbom_supports() starts a new interpreter to run gen-sbom --help on every call, and main() now calls it for up to nine flags (this PR adds three), so one SBOM run spawns up to nine extra Python processes to read the same help text. Caching the help output once (e.g. an lru_cache'd helper that returns it) gives the same answer with one spawn.
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old macro, function, and script names, so a re-sync alone breaks the build.
The CMake helper now also adds install-sbom and uninstall-sbom targets.