fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config - #26
Open
MarkAtwood wants to merge 1 commit into
Open
fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config#26MarkAtwood wants to merge 1 commit into
MarkAtwood wants to merge 1 commit into
Conversation
When WOLFSSL_DIR named a tree, the version came only from wolfssl/version.h. That header is generated by configure as well as tracked, so `make distclean` removes it. With it gone, wv stayed empty, --dep-version was never passed, and gen-sbom fell back to `pkg-config --modversion wolfssl`, which reports the *installed* wolfSSL. On a host whose installed build differs from WOLFSSL_DIR the SBOM recorded that unrelated version and still exited 0, attesting a component the product was not built against. Reported against wolfSSH, where a distclean'd tree yielded 9.9.9 instead of 5.9.2. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, which survives distclean, and fail when a named tree yields neither source rather than letting an installed copy answer for it. With no WOLFSSL_DIR there is no tree to consult, so gen-sbom's pkg-config lookup stays the intended source and the vendored path is unchanged. SBOM_WOLFSSL_VERSION still overrides both.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the shared Automake SBOM recipe so that when WOLFSSL_DIR points at a wolfSSL source tree, the recorded wolfSSL dependency version is taken from that tree (and the build fails if it can’t be determined), rather than silently falling back to the host’s installed wolfSSL via pkg-config.
Changes:
- When
SBOM_WOLFSSL_VERSIONis unset andWOLFSSL_DIRis set, derive wolfSSL version fromwolfssl/version.h, falling back toconfigure.acif needed. - Fail the
sbomtarget if aWOLFSSL_DIRtree is provided but yields no version, preventing incorrect SBOM attribution to an installed wolfSSL. - Expand inline documentation to describe the detection/fallback and failure behavior.
Suppressed comments (1)
share/sbom.am:214
- This error path triggers whenever
wvis still empty, which can happen not only when the files are unreadable/missing, but also when their contents don’t match the expected patterns. The current wording says they were not readable, which can be misleading and complicates debugging.
echo " Neither wolfssl/version.h (generated by configure, so"; \
echo " 'make distclean' removes it) nor configure.ac was"; \
echo " readable. Refusing to fall back to pkg-config: that"; \
echo " reports the *installed* wolfSSL, which may be a"; \
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+200
to
+207
| if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ | ||
| wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ | ||
| "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ | ||
| fi; \ | ||
| if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ | ||
| wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ | ||
| "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ | ||
| fi; \ |
This was referenced Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
WOLFSSL_DIRnames a tree, the wolfSSL dependency version came only fromwolfssl/version.h. That header is generated by configure as well as tracked, somake distcleanremoves it. With it gonewvstayed empty,--dep-versionwas never passed, and gen-sbom fell back topkg-config --modversion wolfssl, which reports the installed wolfSSL.On a host whose installed build differs from
WOLFSSL_DIR, the SBOM recorded that unrelated version and still exited 0. That is a compliance artifact attesting a component the product was not built against. Found against wolfSSH (wolfSSL/wolfssh#1050), where a distclean-ed tree produced9.9.9instead of5.9.2, by runningmake sbomby hand. No CI caught it.Change
AC_INITinWOLFSSL_DIR/configure.ac, which survives distclean.SBOM_WOLFSSL_VERSIONstill overrides both.The
test -n "$(WOLFSSL_DIR)"guard is preserved deliberately. With noWOLFSSL_DIRthere is no tree to consult, so gen-sbom pkg-config lookup remains the intended source and the vendored path is unchanged.Verification
The recipe has no test coverage, so I exercised the shipped bytes directly by extracting the block from
share/sbom.amand running every path:WOLFSSL_DIRversion.h5.9.2configure.aconly5.9.2(the reported bug)--dep-version, pkg-config preservedSBOM_WOLFSSL_VERSION=1.2.31.2.3The fourth row is the regression check that matters: wolfBoot vendors this file and does not always set
WOLFSSL_DIR. All four existing test suites pass.Two things for a follow-up, not this PR
share/sbom.amhas no test coverage.selftest.ymlruns four Python suites and never exercises the Make fragment that wolfBoot, wolfssl, wolfTPM and wolfSSH all vendor. That is why this survived in the canonical copy. The check that finds it needs an adversarial environment: a stubpkg-configreturning a sentinel plus a distclean-ed tree, so a wrong source is distinguishable from a right one. On a runner where the installed and source wolfSSL agree, a naive assertion passes either way.The same defect is still live downstream.
wolfssl/scripts/sbom.am,wolfTPM/scripts/sbom.amandwolfBoot/tools/sbom/sbom.amall carry the identical logic today. wolfBoot copy is byte-identical to canonical, so itswolfglass_driftjob is green while faithfully carrying the bug, and it will stay green after this merges because it checks against its own pinned rev rather than wolfGlass HEAD. wolfBoot needs a re-pin to pick this up.