From 48111fea56fef75a9c7826c24e5f4922813bd058 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 12:48:17 -0700 Subject: [PATCH 1/2] fix(sbom): take wolfSSL version from WOLFSSL_DIR, not pkg-config wolfssl/version.h is generated by configure as well as tracked, so `make distclean` removes it. With it gone the --dep-version override was never passed and gen-sbom fell back to pkg-config, recording the installed wolfSSL's version rather than the tree at WOLFSSL_DIR. Fall back to AC_INIT in WOLFSSL_DIR/configure.ac, and fail when a named tree yields neither source. With no WOLFSSL_DIR the pkg-config lookup remains the intended source. --- scripts/sbom.am | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/scripts/sbom.am b/scripts/sbom.am index 50973598500..91198b041c3 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -36,8 +36,13 @@ # detected from SBOM_LICENSE_FILE. # SBOM_LICENSE_TEXT Path to licence text for any LicenseRef-* used in # SBOM_LICENSE_OVERRIDE (required by SPDX 2.3). -# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency; -# auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset. +# SBOM_WOLFSSL_VERSION Version recorded for the wolfSSL dependency. When +# unset and WOLFSSL_DIR is set, it is read from that tree: +# wolfssl/version.h, else configure.ac (version.h is +# generated, so 'make distclean' removes it). If neither +# is readable the build fails rather than letting gen-sbom +# fall back to pkg-config, which describes the installed +# wolfSSL rather than the tree at WOLFSSL_DIR. # SBOM_OPENSSL_VERSION Version recorded for the OpenSSL dependency; # gen-sbom resolves it via pkg-config when unset. # SBOM_CONFIG_H Path to the configure-generated config header to @@ -169,9 +174,27 @@ sbom: | $(GREP) -q -- '--dep-wolfssl'; then \ dep_args="$$dep_args --dep-wolfssl yes"; \ wv="$(SBOM_WOLFSSL_VERSION)"; \ - if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ - wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ - "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \ + if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \ + wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \ + "$(WOLFSSL_DIR)/wolfssl/version.h"`; \ + fi; \ + if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \ + wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \ + "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \ + fi; \ + if test -z "$$wv"; then \ + echo "ERROR: cannot determine the wolfSSL version from"; \ + echo " $(WOLFSSL_DIR)"; \ + echo " Neither wolfssl/version.h (generated by configure, so"; \ + echo " 'make distclean' removes it) nor configure.ac was"; \ + echo " readable. Refusing to fall back to pkg-config: that"; \ + echo " reports the *installed* wolfSSL, which may be a"; \ + echo " different build than WOLFSSL_DIR, and would record a"; \ + echo " wrong version in the SBOM. Re-run configure in that"; \ + echo " tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \ + exit 1; \ + fi; \ fi; \ if test -n "$$wv"; then \ dep_args="$$dep_args --dep-version wolfssl=$$wv"; \ From 52cc89d561c7e7302643fcf80d9f51dd831fd35d Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Wed, 26 Aug 2026 12:51:24 -0700 Subject: [PATCH 2/2] docs(sbom): drop stale wolfSSL#10343 pre-merge note The NOTE told users to point WOLFSSL_DIR at wolfSSL/wolfssl#10343's branch until it merged. It merged 2026-07-27. Converge on the wording already in the canonical wolfGlass copy, which drops the reference. --- scripts/sbom.am | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/scripts/sbom.am b/scripts/sbom.am index 91198b041c3..80643ee0742 100644 --- a/scripts/sbom.am +++ b/scripts/sbom.am @@ -201,10 +201,7 @@ sbom: fi; \ else \ echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \ - echo " will not list wolfssl as a dependency component. That"; \ - echo " support is added by wolfSSL/wolfssl#10343; until it merges"; \ - echo " to wolfssl master, point WOLFSSL_DIR at that PR's branch"; \ - echo " to enable it. The generated SBOM is valid either way."; \ + echo " will not list wolfssl as a dependency component."; \ fi; \ fi; \ if test "$(SBOM_DEP_OPENSSL)" = yes; then \