SBOM dep cpe purl - #11120
Open
sameehj wants to merge 2 commits into
Open
Conversation
A dependency component carried only a PURL, so an integrator whose vulnerability monitoring keys on NVD (as a CRA / IEC 62443 process does) could not see the wolfSSL that a downstream product links, and wolfSSL advisories never reached them. Every DEP_META entry now declares the vendor:product pair NVD registers, emitted as CycloneDX `cpe` and as an SPDX cpe23Type external reference. Both identifiers are version-bearing, so neither is emitted when the version cannot be resolved: a CPE with an empty version field matches every release of the dependency. The PURLs did not resolve either. purl-spec requires the namespace and name of the `github` type to be lowercased, and the version is a git ref, so `pkg:github/wolfSSL/wolfssl@v5.9.1` was both non-canonical and a dangling reference: wolfSSL releases are tagged `v5.9.1-stable`. GITHUB_TAG_FORMS records the tag form per project, since the stack is not consistent about it (wolfSSH is `-stable`, wolfTPM is not, wolfHSM prefixes the project name). Ported from the wolfGlass engine, which carries the same change. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
wolfSSL's own SBOM listed wolfcrypt as something wolfssl DEPENDS_ON, which describes a third-party library rather than a part of this release. SPDX now records CONTAINS, matching how a downstream product's SBOM expresses the same relationship after the generator refresh, so the two documents agree about what wolfCrypt is. The generator is synced from wolfGlass, which also stops publishing a `cpe` for a product NVD has not listed yet and adds --crypto-only for builds that compile in the crypto subset alone. One test still asserted that a valueless `#define X` is recorded as '1'; that was changed in 1.3 precisely because it made `#define X` and `#define X 1` indistinguishable and misread any macro naming a quantity. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11120
No scan targets match the changed files in this PR. Review skipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Improve SBOM generation so dependency and subcomponent identities are usable for automated vulnerability scanning (CRA / IEC 62443 style monitoring).
cpe/ SPDXcpe23Type), not PURL alone.pkg:githubPURLs (lowercase namespace/name; real release tags such asv<version>-stablefor wolfSSL).CONTAINS), not as an externalDEPENDS_ON.scripts/gen-sbomwith the wolfGlass generator: do not publish acpefor products that are not in the NVD Official CPE Dictionary; support crypto-only builds via--crypto-only.This supports corrected release SBOMs for integrators (e.g. wolfSSL 5.9.1) and matches the identity model used by downstream products such as wolfBoot.
Fixes zd#22297
Testing
scripts/test_gen_sbom.py(updated/extended for CPE, PURL forms, wolfCrypt containment, omit CPE when version unknown / product pending).cpe:2.3:a:wolfssl:wolfssl:…andcpe:2.3:a:wolfssl:wolfcrypt:…presentpkg:github/wolfssl/…and@v…-stablewhere applicableCONTAINSChecklist