fix(sbom): correctness fixes in gen-sbom

Three review-driven correctness fixes in scripts/gen-sbom,
each shipping with its own regression tests:

  * parse_options_h corrupted #define values that contained
    a string literal with '/' characters: 're.split(r"/\\*|//",
    raw, maxsplit=1)[0]' truncated PACKAGE_URL="https://..."
    at the first // inside the URL, so the SBOM emitted
    'PACKAGE_URL = "https:'.  Replace the regex with a
    string-literal-aware state machine (_strip_define_comment)
    so quoted '/' characters survive.  Char literals are not
    handled (autoconf does not emit them, pcpp normalises
    user_settings.h before this code sees the value).
    Adds four regression tests to TestParseOptionsH (1zj.22).

  * --lib accepted /dev/null and emitted the well-known empty-
    file SHA-256 (e3b0c44...b855) as the wolfSSL component
    checksum.  Both SPDX and CDX validators accepted the
    result, so a misconfigured build silently shipped an SBOM
    whose hash matched no compiled wolfSSL artefact.  Hard-fail
    on size==0 --lib, with an actionable error.  Soft-warn on
    zero-byte --srcs entries because cross-compile setups
    legitimately include touch'd placeholders.  Adds
    test_empty_lib_is_rejected and
    test_zero_byte_srcs_warn_but_do_not_fail (1zj.23).

  * detect_license regex 'or\\s+(any\\s+)?later' failed to
    match the canonical FSF GPL preamble phrase 'or (at your
    option) any later version' used verbatim in millions of
    upstream COPYING files: the parenthetical interjected
    between 'or' and 'any later'.  Any LICENSING that copied
    the FSF preamble was silently mis-detected as GPL-X.0-only.
    Broaden to 'or\\s+(?:[^,.;\\n]*?\\s+)?(?:any\\s+)?later'
    -- the negative class keeps the match within a sentence so
    unrelated 'or' / 'later' tokens further down the file do
    not promote a GPLv2-only declaration.  Adds GPLv2 + GPLv3
    canonical-preamble regression guards.  The shipping wolfSSL
    LICENSING still maps to GPL-3.0-only; locked down by
    test_real_wolfssl_licensing_is_gpl3_only (1zj.24).

Also rebinds the test_zero_byte_srcs_warn_but_do_not_fail
tempfile paths before the try-block so the finally clause
references live filenames on the assertion-failure path
instead of leaking renamed tempfiles in /tmp (e8o.2).

Closes wolfssl-1zj.22, wolfssl-1zj.23, wolfssl-1zj.24,
wolfssl-e8o.2

Author: MarkAtwood

scripts/gen-sbom

@@ -192,7 +192,16 @@ def detect_license(license_file):
 
     version = m.group(1)
     excerpt = text[m.end():m.end() + 100]
-    if re.search(r'or\s+(any\s+)?later', excerpt, re.IGNORECASE):
+    # Match upgrade-permission wording in the 100-byte excerpt that
+    # follows the version mention.  Three FSF-derived shapes:
+    #   * canonical preamble:   "or (at your option) any later version"
+    #   * preamble variant:     "or (at the licensee's option) any later"
+    #   * compact form:         "or later" / "or any later"
+    # The optional `[^,.;\n]*?\s+` group consumes parenthesised
+    # asides without crossing sentence boundaries so unrelated
+    # "or" / "later" mentions in surrounding prose do not match.
+    if re.search(r'or\s+(?:[^,.;\n]*?\s+)?(?:any\s+)?later',
+                 excerpt, re.IGNORECASE):
         return f'GPL-{version}.0-or-later'
     return f'GPL-{version}.0-only'
 
@@ -338,6 +347,45 @@ def _is_noise_macro(name):
     return False
 
 
+def _strip_define_comment(raw):
+    """Strip trailing C/C++ comment from a #define value while preserving
+    `/`-bearing characters that appear inside a double-quoted string.
+
+    Earlier versions used `re.split(r'/\\*|//', raw, maxsplit=1)[0]`, which
+    is unaware of string literals.  That regex corrupts autoconf-generated
+    defines such as
+
+        #define PACKAGE_URL "https://www.wolfssl.com"
+        #define PACKAGE_BUGREPORT "https://github.com/wolfssl/wolfssl/issues"
+
+    by truncating at the first `//` inside the URL — both end up as
+    `"https:` in the SBOM build properties, falsely showing PACKAGE_URL
+    drifting between releases when nothing actually changed.
+
+    Char literals are not handled: autoconf-generated options.h does not
+    emit them, and pcpp normalises customer user_settings.h before this
+    helper sees the value, so the only realistic source of `/` in a
+    #define value is a quoted string."""
+    in_str = False
+    i = 0
+    n = len(raw)
+    while i < n:
+        c = raw[i]
+        if in_str:
+            if c == '\\' and i + 1 < n:
+                i += 2
+                continue
+            if c == '"':
+                in_str = False
+        else:
+            if c == '"':
+                in_str = True
+            elif c == '/' and i + 1 < n and raw[i + 1] in '/*':
+                return raw[:i]
+        i += 1
+    return raw
+
+
 def parse_options_h(path):
     """Parse a flat `#define` header and return a sorted deduplicated
     list of (name, value) pairs for every wolfSSL-relevant macro.
@@ -354,7 +402,9 @@ def parse_options_h(path):
 
     Trailing C/C++ comments on a #define line (`#define HAVE_FOO 42 /* x */`
     or `// y`) are stripped; otherwise they would land verbatim in the
-    SBOM build properties."""
+    SBOM build properties.  String literals are preserved intact so that
+    URLs in PACKAGE_URL / PACKAGE_BUGREPORT are not truncated at the
+    first `//` (see _strip_define_comment)."""
     try:
         with open(path) as f:
             text = f.read()
@@ -368,7 +418,7 @@ def parse_options_h(path):
         if _is_noise_macro(name):
             continue
         raw = (m.group(2) or '')
-        raw = re.split(r'/\*|//', raw, maxsplit=1)[0]
+        raw = _strip_define_comment(raw)
         defines[name] = raw.strip()
     return sorted(defines.items())
 
@@ -898,10 +948,40 @@ def main():
         )
 
     if args.lib:
+        # Refuse the empty-file SHA-256 as a component checksum.  A
+        # build that points --lib at /dev/null, a stub touch(1)'d
+        # placeholder, or an empty .a that failed to ar-create would
+        # otherwise emit a valid-looking SBOM whose hash matches no
+        # compiled wolfSSL artefact ever shipped.  The SBOM passes
+        # both spec validators -- nothing else catches it.
+        try:
+            lib_size = os.path.getsize(args.lib)
+        except OSError as e:
+            sys.exit(f"ERROR: cannot stat --lib {args.lib!r}: {e}")
+        if lib_size == 0:
+            sys.exit(
+                f"ERROR: --lib {args.lib!r} is empty (0 bytes); refusing "
+                "to emit an SBOM with the empty-file SHA-256 as the "
+                "component checksum.  Verify your build produced a "
+                "real library artefact.")
         lib_hash = sha256_file(args.lib)
         hash_kind = 'library-binary'
         srcs_basenames = None
     else:
+        # --srcs is the embedded entry point.  Zero-byte files in the
+        # set are uncommon but not necessarily wrong (a cross-compile
+        # toolchain may stub a per-target source with touch); warn
+        # rather than fail so the customer can decide whether the
+        # gitoid for an empty blob is what they want recorded.
+        zero_byte_srcs = [
+            p for p in args.srcs if os.path.isfile(p) and os.path.getsize(p) == 0
+        ]
+        if zero_byte_srcs:
+            print(
+                "WARNING: zero-byte source files in --srcs (gitoid will "
+                "be the well-known empty-blob hash for these): "
+                + ', '.join(zero_byte_srcs),
+                file=sys.stderr)
         lib_hash = srcs_merkle_hash(args.srcs)
         hash_kind = 'source-merkle-omnibor'
         srcs_basenames = sorted({os.path.basename(p) for p in args.srcs})

scripts/test_gen_sbom.py

@@ -306,19 +306,40 @@ def test_gplv2_only(self):
     def test_gplv2_or_later_any_form(self):
         # 'or any later' immediately after the version mention.
         # Oracle: SPDX 'GPL-2.0-or-later'.
-        # NOTE: the canonical FSF preamble phrase 'or (at your option)
-        # any later version' is NOT matched by the current regex
-        # (the parenthetical interjection breaks the pattern).  That
-        # is a separate limitation tracked in its own beads issue;
-        # this test deliberately uses a pattern the existing regex
-        # handles, so it serves as a regex regression guard rather
-        # than a redesign request.
         self.assertEqual(
             self._detect(
                 'Licensed under the GNU General Public License version 2, '
                 'or any later version.\n'),
             'GPL-2.0-or-later')
 
+    def test_gplv2_or_later_canonical_fsf_preamble(self):
+        # The canonical FSF GPL preamble phrase, used verbatim in
+        # millions of upstream COPYING files:
+        #
+        #   'either version N of the License, or (at your option)
+        #    any later version.'
+        #
+        # An earlier regex (`or\s+(any\s+)?later`) failed to match
+        # this because the parenthetical '(at your option)'
+        # interjects between 'or' and 'any later', so wolfssl-1zj.24
+        # silently mis-detected the preamble as GPLv2-only.  Oracle:
+        # SPDX 'GPL-2.0-or-later'.
+        self.assertEqual(
+            self._detect(
+                'This program is free software: you can redistribute it '
+                'and/or modify it under the terms of the GNU General '
+                'Public License version 2, or (at your option) any '
+                'later version.\n'),
+            'GPL-2.0-or-later')
+
+    def test_gplv3_or_later_canonical_fsf_preamble(self):
+        # Same regression guard for GPLv3.
+        self.assertEqual(
+            self._detect(
+                'Licensed under the GNU General Public License version 3, '
+                'or (at your option) any later version.\n'),
+            'GPL-3.0-or-later')
+
     def test_gplv2_or_later_short_form(self):
         # 'or later' (without 'any') also matches the regex; this
         # variant appears in some upstream COPYING files.  Oracle:
@@ -488,6 +509,48 @@ def test_strips_comment_from_valueless_define(self):
         pairs = dict(self._parse("#define HAVE_BAR  /* set elsewhere */\n"))
         self.assertEqual(pairs['HAVE_BAR'], '')
 
+    def test_preserves_url_in_string_literal(self):
+        # Regression guard: an earlier comment-stripper used
+        # `re.split(r'/\*|//', raw, maxsplit=1)[0]`, which truncated
+        # autoconf-generated PACKAGE_URL / PACKAGE_BUGREPORT defines
+        # at the first `//` inside the URL.  Both ended up as
+        # `"https:` in the SBOM build properties, falsely showing
+        # PACKAGE_URL drifting between releases when nothing changed.
+        pairs = dict(self._parse(
+            '#define PACKAGE_URL "https://www.wolfssl.com"\n'
+            '#define PACKAGE_BUGREPORT '
+            '"https://github.com/wolfssl/wolfssl/issues"\n'
+        ))
+        self.assertEqual(pairs['PACKAGE_URL'],
+                         '"https://www.wolfssl.com"')
+        self.assertEqual(pairs['PACKAGE_BUGREPORT'],
+                         '"https://github.com/wolfssl/wolfssl/issues"')
+
+    def test_strips_comment_after_string_literal(self):
+        # Companion to test_preserves_url_in_string_literal: confirm
+        # the stripper still works when a comment legitimately follows
+        # a string literal.  A regression that disabled stripping
+        # entirely (the simplest "fix" for the URL bug) would let
+        # comment text leak into the SBOM.
+        pairs = dict(self._parse(
+            '#define PACKAGE_URL "https://www.wolfssl.com" /* upstream */\n'
+        ))
+        self.assertEqual(pairs['PACKAGE_URL'],
+                         '"https://www.wolfssl.com"')
+
+    def test_preserves_block_comment_inside_string_literal(self):
+        # `/*` inside a string literal must not start a comment.
+        pairs = dict(self._parse('#define WEIRD "a/*b*/c"\n'))
+        self.assertEqual(pairs['WEIRD'], '"a/*b*/c"')
+
+    def test_handles_escaped_quote_in_string_literal(self):
+        # An escaped `\"` inside a string literal must not be mistaken
+        # for the closing quote; otherwise a comment-marker that
+        # follows would be incorrectly treated as outside the string.
+        pairs = dict(self._parse(
+            '#define EMBEDDED_QUOTE "a\\"b//c" /* tail */\n'))
+        self.assertEqual(pairs['EMBEDDED_QUOTE'], '"a\\"b//c"')
+
     def test_dedup_keeps_last_assignment(self):
         # Last assignment wins (matches C preprocessor semantics for
         # duplicate #defines after redefinition).
@@ -1282,11 +1345,18 @@ def test_licenseref_with_license_text_is_accepted(self):
                                          delete=False) as f:
             f.write('Plain-text wolfSSL commercial licence text.\n')
             license_text_path = f.name
+        # --lib must be non-empty (gen-sbom refuses /dev/null as a
+        # component checksum); use a tiny stand-in file so we exercise
+        # the LicenseRef gate without tripping the empty-lib gate.
+        with tempfile.NamedTemporaryFile('wb', suffix='.so',
+                                         delete=False) as f:
+            f.write(b'\x7fELF stub')
+            lib_path = f.name
         try:
             result = self._run(
                 *self.BASE,
                 '--options-h', '/dev/null',
-                '--lib', '/dev/null',
+                '--lib', lib_path,
                 '--license-override', 'LicenseRef-wolfSSL-Commercial',
                 '--license-text', license_text_path)
             self.assertEqual(
@@ -1295,6 +1365,69 @@ def test_licenseref_with_license_text_is_accepted(self):
                 f'pair: stderr={result.stderr!r}')
         finally:
             os.unlink(license_text_path)
+            os.unlink(lib_path)
+
+    def test_empty_lib_is_rejected(self):
+        # The --lib argument is the wolfSSL component checksum source.
+        # An empty file produces the well-known empty-file SHA-256
+        # (e3b0c44...b855), which is a valid-looking hash that
+        # matches no real wolfSSL build artefact ever shipped.  Both
+        # SPDX and CDX validators accept it; nothing else catches
+        # the lie.  gen-sbom must refuse zero-byte --lib.
+        result = self._run(
+            *self.BASE,
+            '--options-h', '/dev/null',
+            '--lib', '/dev/null')
+        self.assertNotEqual(result.returncode, 0,
+                            'gen-sbom accepted an empty --lib file; would '
+                            'have shipped an SBOM with the empty-file '
+                            'SHA-256 as the wolfSSL component checksum')
+        self.assertIn('empty', result.stderr.lower())
+        self.assertIn('--lib', result.stderr)
+
+    def test_zero_byte_srcs_warn_but_do_not_fail(self):
+        # Companion: --srcs may legitimately include zero-byte
+        # placeholders in cross-compile setups (a target file the
+        # build system creates with touch but doesn't compile yet),
+        # so gen-sbom emits a WARNING rather than failing.  This
+        # gives the embedded customer a chance to see they have a
+        # stub file in the source set without breaking their build.
+        with tempfile.NamedTemporaryFile('wb', suffix='.c',
+                                         delete=False) as f:
+            f.write(b'/* real source */\n')
+            real_src = f.name
+        with tempfile.NamedTemporaryFile('wb', suffix='.c',
+                                         delete=False) as f:
+            empty_src = f.name
+        # Rename so the basenames are distinct (srcs_merkle_hash
+        # rejects duplicate basenames; see TestSrcsMerkleHash).
+        # Rename and rebind BEFORE the try-block so the finally
+        # clause always references the live filenames even when an
+        # assertion fails.
+        real_renamed = real_src + '.real.c'
+        empty_renamed = empty_src + '.empty.c'
+        os.rename(real_src, real_renamed)
+        os.rename(empty_src, empty_renamed)
+        real_src = real_renamed
+        empty_src = empty_renamed
+        try:
+            result = self._run(
+                *self.BASE,
+                '--user-settings', '/dev/null',
+                '--srcs', real_src, empty_src)
+            # The standalone path with /dev/null user-settings should
+            # complete; the only thing we care about here is that an
+            # empty source did not abort the run.
+            self.assertEqual(
+                result.returncode, 0,
+                f'gen-sbom failed with zero-byte source: stderr={result.stderr!r}')
+            self.assertIn('zero-byte source', result.stderr)
+        finally:
+            for p in (real_src, empty_src):
+                try:
+                    os.unlink(p)
+                except FileNotFoundError:
+                    pass
 
     def test_user_settings_path_in_help(self):
         # Discoverability regression guard - if the standalone entry