From c65ca911a9ab4847c19c2b2dfa97f26c7b2c2d2c Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 12:35:51 -0700 Subject: [PATCH] fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config When WOLFSSL_DIR named a tree, the version came only from wolfssl/version.h. That header is generated by configure as well as tracked, so `make distclean` removes it. With it gone, wv stayed empty, --dep-version was never passed, and gen-sbom fell back to `pkg-config --modversion wolfssl`, which reports the *installed* wolfSSL. On a host whose installed build differs from WOLFSSL_DIR the SBOM recorded that unrelated version and still exited 0, attesting a component the product was not built against. Reported against wolfSSH, where a distclean'd tree yielded 9.9.9 instead of 5.9.2. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, which survives distclean, and fail when a named tree yields neither source rather than letting an installed copy answer for it. With no WOLFSSL_DIR there is no tree to consult, so gen-sbom's pkg-config lookup stays the intended source and the vendored path is unchanged. SBOM_WOLFSSL_VERSION still overrides both. --- share/sbom.am | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/share/sbom.am b/share/sbom.am index 32b4a60..8782166 100644 --- a/share/sbom.am +++ b/share/sbom.am @@ -33,8 +33,15 @@ # detected from SBOM_LICENSE_FILE. # SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in # SBOM_LICENSE_OVERRIDE (required by SPDX 2.3). -# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency; -# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset. +# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When +# unset and WOLFSSL_DIR is set, it is read from that tree: +# wolfssl/version.h, else configure.ac (version.h is +# generated, so 'make distclean' removes it). If neither +# is readable the build fails rather than letting gen-sbom +# fall back to pkg-config, which describes the installed +# wolfSSL rather than the tree at WOLFSSL_DIR. With no +# WOLFSSL_DIR there is no tree to consult and gen-sbom's +# pkg-config lookup is the intended source. # SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency; # gen-sbom resolves it via pkg-config when unset. # SBOM_CONFIG_H Path to the configure-generated config header to @@ -189,9 +196,27 @@ sbom: | $(GREP) -q -- '--dep-wolfssl'; then \ dep_args="$$dep_args --dep-wolfssl yes"; \ wv="$(SBOM_WOLFSSL_VERSION)"; \ - if test -z "$$wv" && test -n "$(WOLFSSL_DIR)" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ - wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ - "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \ + if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ + wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ + "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + fi; \ + if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ + wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ + "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ + fi; \ + if test -z "$$wv"; then \ + echo "ERROR: cannot determine the wolfSSL version from"; \ + echo " $(WOLFSSL_DIR)"; \ + echo " Neither wolfssl/version.h (generated by configure, so"; \ + echo " 'make distclean' removes it) nor configure.ac was"; \ + echo " readable. Refusing to fall back to pkg-config: that"; \ + echo " reports the *installed* wolfSSL, which may be a"; \ + echo " different build than WOLFSSL_DIR, and would record a"; \ + echo " wrong version in the SBOM. Re-run configure in that"; \ + echo " tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \ + exit 1; \ + fi; \ fi; \ if test -n "$$wv"; then \ dep_args="$$dep_args --dep-version wolfssl=$$wv"; \