Repository navigation
Conversation
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old function and script names, so a re-sync alone breaks the CMake build. - Re-vendor tools/sbom/ at 8a96c64 and pin it in .wolfssl-compliance-tooling-rev. - Call wolfssl_compliance_tooling_add_sbom in CMakeLists.txt. - Add the new vendored files to EXTRA_DIST, so the release tarball has what the CMake helper needs. - Point the drift check at wolfSSL/wolfssl-compliance-tooling and rename the job to compliance_tooling_drift. - Use the new name in the docs, the Japanese docs, and comments. The CMake helper now also adds install-sbom and uninstall-sbom targets.
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved SBOM defects bypass validation and omit SPDX installation, break DESTDIR staging, and mishandle Zephyr sources, compiler launchers, and cross-drive inputs.
5 open issues
What changed in this PR
Migrates wolfTPM’s vendored SBOM tooling from wolfGlass to wolfssl-compliance-tooling, updating build integration, release packaging, and documentation for the renamed upstream project.
Changes:
- Pins the refreshed tooling to
8a96c64and updates the drift-check workflow. - Adopts the renamed CMake helper and adds SBOM installation, removal, and reproducible-timestamp support.
- Refreshes generation, validation, and source extraction across supported build systems.
| File | Description |
|---|---|
tools/sbom/validate_sbom.py |
Improves file and JSON validation errors. |
tools/sbom/sbom.am |
Adds artifact overrides and metadata options. |
tools/sbom/sbom-driver.py |
Updates input validation and generator options. |
tools/sbom/sbom-driver |
Renames tooling in the wrapper comment. |
tools/sbom/README.md |
Documents updated interfaces and installation targets. |
tools/sbom/gen-sbom |
Adds atomic writes and configurable copyright metadata. |
tools/sbom/frontends/zephyr_sbom.py |
Uses compilation databases for source and macro extraction. |
tools/sbom/frontends/included_sources.py |
Adds discovery of source files included through preprocessing. |
tools/sbom/frontends/iar_sbom.py |
Honors configuration-specific source exclusions. |
tools/sbom/frontends/compdb_sbom.py |
Adds source filtering, macro conflict checks, and included-source scanning. |
tools/sbom/build/uninstall-sbom.cmake |
Removes installed SBOM artifacts. |
tools/sbom/build/sbom.mk |
Renames the Make macro and forwards new options. |
tools/sbom/build/sbom.cmake |
Updates the helper and adds installation targets. |
tools/sbom/build/sbom-with-sde.cmake |
Resolves reproducible timestamps at build time. |
tools/sbom/build/sbom-paths.cmake |
Resolves shared installation artifact paths. |
tools/sbom/build/install-sbom.cmake |
Installs SBOM artifacts with staging support. |
tools/sbom/.wolfssl-compliance-tooling-rev |
Pins the new upstream revision. |
tools/sbom/.wolfglass-rev |
Removes the old revision pin. |
Makefile.am |
Includes new vendored files in release archives. |
docs/sbom-and-compliance.md |
Updates tooling names and references. |
docs/ja/sbom-and-compliance.md |
Updates Japanese documentation references. |
CMakeLists.txt |
Calls the renamed SBOM helper. |
.github/workflows/sbom.yml |
Updates the drift-check repository, pin, and command. |
Review effort: Balanced
| list(APPEND _sbom_args DEP_VERSION "wolfssl=${_sbom_wolfssl_version}") | ||
| endif() | ||
| wolfglass_add_sbom(${_sbom_args}) | ||
| wolfssl_compliance_tooling_add_sbom(${_sbom_args}) |
| list(APPEND _sbom_args DEP_VERSION "wolfssl=${_sbom_wolfssl_version}") | ||
| endif() | ||
| wolfglass_add_sbom(${_sbom_args}) | ||
| wolfssl_compliance_tooling_add_sbom(${_sbom_args}) |
| continue | ||
| if root_abs: | ||
| real = os.path.realpath(fpath) | ||
| if os.path.commonpath([real, root_abs]) != root_abs: |
Comment on lines
+92
to
+94
| if (not out.startswith(lib_dir) | ||
| or not src.lower().endswith(SRC_EXTS)): | ||
| continue |
Comment on lines
+145
to
+147
| if not toks: | ||
| raise ParseError(f"empty compile command for {entry.get('file')}") | ||
| return toks |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wolfGlass is now wolfssl-compliance-tooling. Its master removed the old function and script names, so a re-sync alone breaks the CMake build.
The CMake helper now also adds install-sbom and uninstall-sbom targets.