[sameehj]

Problem

The wolfSSL Jenkins source-text check rejects hard tabs in *.mk files. wolfSSL PR wolfSSL/wolfssl#11701 vendors share/ into tools/sbom/, and the check fails on tools/sbom/build/sbom.mk. Other wolfSSL .mk files are in folders that the check skips (for example IDE/), so sbom.mk is the first .mk file that the check examines.

Change

• Each recipe line in wolfssl_compliance_tooling_sbom_rule starts with $(SBOM_TAB), not a literal tab.
• SBOM_TAB := $(shell printf '\t'). $(call) expands it before $(eval) parses the rule, so make reads the same recipe.
• Continuation lines start with spaces.

The file has no tab characters now. It does not use .RECIPEPREFIX, so it still works with GNU make 3.81 (the macOS make).

Test

I ran the old and new sbom.mk with a stub driver that prints its arguments, with GNU make 3.81, in these cases:

• the default target, with SBOM_SRCS, $$(( )) in SBOM_CFLAGS, SBOM_DEP_VERSION, and wolfssl/wolfcrypt version detection
• a second target made with $(eval $(call ...,sbom-hal,SBOM_HAL_)), with SBOM_HAL_LIB and with SBOM_HAL_NO_ARTIFACT_HASH=1
• the error checks for a missing name, a missing composition, and NO_ARTIFACT_HASH combined with SRCS or LIB

The driver arguments, the error messages, and the exit codes were the same in all cases. I did not test with GNU make 4.x.

Follow-up

After this PR merges, wolfSSL/wolfssl#11701 must re-pin tools/sbom/.wolfssl-compliance-tooling-rev to the commit on master.

[Copilot]

🟢 Approval recommended

There are no active review issues for the SBOM makefile’s literal-tab removal.

No open issues 🎉

What changed in this PR

Removes literal tabs from the shared SBOM makefile so it can pass wolfSSL’s Jenkins source-text check when vendored, while preserving recipe behavior and GNU make 3.81 compatibility.

Changes:

• Introduces SBOM_TAB to generate recipe-leading tabs during macro expansion.
• Replaces literal tabs with $(SBOM_TAB) at recipe starts and spaces on continuation lines, without using .RECIPEPREFIX.

File	Description
share/​build/​sbom.mk	Removes literal tabs while preserving SBOM recipe commands and arguments.

_{Review effort: Balanced}

[Frauschi]

I ran the old and new sbom.mk against a stub driver on make 3.81 and 4.4.1. Driver arguments, error messages and exit codes match, so the 4.x gap from the description is covered. A few small things inline.

[Frauschi]

Nothing in this repo checks that sbom.mk stays tab-free, and no test runs it at all. The next edit that adds a recipe line with a tab passes CI here and only fails in wolfSSL's Jenkins after the re-sync.

Could you add a small test, e.g. tests/test_sbom_mk.py, that asserts the file has no \t and, when make is on PATH, runs the default target and a second $(call ...) target against a stub driver? The cases from the PR description would be a good set.

[Frauschi]

If $(shell printf '\t') comes back empty (a SHELL without printf) or someone passes SBOM_TAB=x on the command line, every make that includes this file now stops at parse time with missing separator at the $(eval $(call ...)) line. Before, only make sbom failed. Not a problem for wolfBoot today, but a guard is cheap and gives a real error:

override SBOM_TAB := $(shell printf '\t')
ifeq ($(SBOM_TAB),)
$(error sbom.mk needs a POSIX shell with printf to build its recipes)
endif

I checked this on make 3.81 and 4.4.1.

[Frauschi]

This explains how $(call) and $(eval) expand, but not why the file avoids tabs, which is what the next editor needs to know. One line would do, something like # wolfSSL's source check rejects literal tabs in .mk files.