From 8a4cb1ff469608f803aaa24c5bab8eef9ff502fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Tue, 20 Oct 2026 11:49:05 +0200 Subject: [PATCH] Add a version header, declare the PURL for west spdx Zephyr's west spdx records a module's identifiers in modules-deps.spdx only from the security: external-references list in zephyr/module.yml. wolfPSA had none, so an SBOM made with west spdx gave a vulnerability scanner nothing to match the wolfPSA sources against. Add the pkg:github PURL of the v5.9.4 release, in the form the wolfSSL SBOM tooling emits. There is no CPE: NVD does not list wolfPSA yet, and an unlisted CPE would read as a match that does not exist. wolfPSA had no machine-readable version, only the CHANGELOG heading and README text. Add wolfpsa/wolfpsa_version.h with LIBWOLFPSA_VERSION_STRING and LIBWOLFPSA_VERSION_HEX in the same form as wolfSSL's version.h, with the decimal digits in place (5.10.12 is 0x05010012). It is also the version source the SBOM tooling's --version-file/--version-macro needs. The name is not version.h because the Zephyr module puts wolfpsa/ first on the global include path, where it would shadow the that wolfSSL's settings.h and wc_port.h fall back to. Add a Version Check workflow running .github/scripts/check-version.sh. It fails when the HEX value, the first CHANGELOG heading (skipping an "Unreleased" section), the module.yml PURL or the README's "wolfPSA vX.Y.Z" disagree with the header, and on a tag push whose name is not vX.Y.Z. The wolfSSL -stable pins are not checked, since CI moves to a new wolfSSL release before the matching wolfPSA release. --- .github/scripts/check-version.sh | 73 +++++++++++++++++++++++++++++ .github/workflows/version-check.yml | 18 +++++++ wolfpsa/wolfpsa_version.h | 28 +++++++++++ zephyr/module.yml | 3 ++ 4 files changed, 122 insertions(+) create mode 100755 .github/scripts/check-version.sh create mode 100644 .github/workflows/version-check.yml create mode 100644 wolfpsa/wolfpsa_version.h diff --git a/.github/scripts/check-version.sh b/.github/scripts/check-version.sh new file mode 100755 index 0000000..d2a034f --- /dev/null +++ b/.github/scripts/check-version.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +# +# Copyright (C) 2026 wolfSSL Inc. +# SPDX-License-Identifier: GPL-3.0-or-later +# +# Check that the release version strings match wolfpsa/wolfpsa_version.h. +# Run from anywhere; exits non-zero if any of them disagrees. + +set -euo pipefail + +cd "$(dirname "$0")/../.." + +fail=0 + +err() { + echo "error: $*" >&2 + fail=1 +} + +ver=$(sed -nE 's/^#define LIBWOLFPSA_VERSION_STRING "([^"]*)".*/\1/p' \ + wolfpsa/wolfpsa_version.h) +hex=$(sed -nE 's/^#define LIBWOLFPSA_VERSION_HEX (0x[0-9A-Fa-f]+).*/\1/p' \ + wolfpsa/wolfpsa_version.h) + +num='(0|[1-9][0-9]*)' +if ! [[ "$ver" =~ ^$num\.$num\.$num$ ]]; then + echo "error: wolfpsa/wolfpsa_version.h: LIBWOLFPSA_VERSION_STRING" \ + "'$ver' is not X.Y.Z" >&2 + exit 1 +fi +want_hex=$(printf '0x%02d%03d%03d' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" \ + "${BASH_REMATCH[3]}") +if [ "$(echo "$hex" | tr 'A-F' 'a-f')" != "$want_hex" ]; then + err "wolfpsa/wolfpsa_version.h: LIBWOLFPSA_VERSION_HEX is '$hex'," \ + "expected $want_hex" +fi + +echo "wolfPSA version: $ver" + +delim='[:space:]`"'"'"'()<>,;' +tag="v[0-9][^$delim]*[^$delim.:]" + +# check FILE DESCRIPTION PREFIX: each PREFIX in FILE must be PREFIXv$ver +check() { + local file=$1 what=$2 prefix=$3 found m + found=$(grep -oE "$prefix$tag" "$file" || true) + if [ -z "$found" ]; then + err "$file: no $what found" + return + fi + while IFS= read -r m; do + m=${m#"${m%%v[0-9]*}"} + if [ "$m" != "v$ver" ]; then + err "$file: $what is $m, expected v$ver" + fi + done <<< "$found" +} + +latest=$(grep -E '^## ' CHANGELOG.md | grep -m1 -viE '^## \[?unreleased' \ + || true) +if [ "${latest%% (*}" != "## v$ver" ]; then + err "CHANGELOG.md: latest release heading is '$latest', expected v$ver" +fi +check zephyr/module.yml "PURL" \ + '^[[:space:]]*- ["'"'"']?pkg:github/wolfssl/wolfpsa@' +check README.md "wolfPSA version" 'wolfPSA ' + +if [ "${GITHUB_REF_TYPE:-}" = "tag" ] && [ "${GITHUB_REF_NAME:-}" != "v$ver" ] +then + err "tag ${GITHUB_REF_NAME:-} does not match version v$ver" +fi + +exit $fail diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml new file mode 100644 index 0000000..b48ec97 --- /dev/null +++ b/.github/workflows/version-check.yml @@ -0,0 +1,18 @@ +name: Version Check + +on: + push: + pull_request: + +permissions: + contents: read + +jobs: + version-check: + runs-on: ubuntu-latest + steps: + - name: Check out wolfPSA + uses: actions/checkout@v5 + + - name: Check version strings against wolfpsa/wolfpsa_version.h + run: .github/scripts/check-version.sh diff --git a/wolfpsa/wolfpsa_version.h b/wolfpsa/wolfpsa_version.h new file mode 100644 index 0000000..66e6b0a --- /dev/null +++ b/wolfpsa/wolfpsa_version.h @@ -0,0 +1,28 @@ +/* wolfpsa_version.h + * + * Copyright (C) 2026 wolfSSL Inc. + * + * This file is part of wolfPSA. + * + * wolfPSA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfPSA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef WOLFPSA_VERSION_H +#define WOLFPSA_VERSION_H + +#define LIBWOLFPSA_VERSION_STRING "5.9.4" +#define LIBWOLFPSA_VERSION_HEX 0x05009004 + +#endif /* WOLFPSA_VERSION_H */ diff --git a/zephyr/module.yml b/zephyr/module.yml index 63b192e..e280b24 100644 --- a/zephyr/module.yml +++ b/zephyr/module.yml @@ -4,3 +4,6 @@ build: kconfig: zephyr/Kconfig depends: - wolfssl +security: + external-references: + - pkg:github/wolfssl/wolfpsa@v5.9.4