feat: SBOM generation and OmniBOR build provenance (CRA compliance)#10343

Open

MarkAtwood wants to merge 38 commits into

wolfSSL:masterfrom

MarkAtwood:feat/sbom-bomsh

Commits on Jun 15, 2026

feat: SBOM generation and OmniBOR build provenance (CRA compliance)

MarkAtwood
authored and
sameehj
committed
fix(sbom): library discovery, reproducibility, install lifecycle
sameehj
committed
fix(sbom): SPDX 2.3 LicenseRef compliance
sameehj
committed
test(sbom): unit tests and CI integration workflow
sameehj
committed
fix(sbom): correctness fixes from code review
sameehj
committed
test(sbom): regression coverage and macOS CI job
sameehj
committed
refactor(sbom): DRY library glob, tighten regression tests
sameehj
committed
chore(sbom): minor cleanups from code review
sameehj
committed
fix(sbom): adapt to upstream removal of liboqs/libxmss/liblms gates
sameehj
committed
fix(sbom): record liboqs as linked artefact, not algorithm
sameehj
committed
refactor(sbom): drop unreachable git_root fallback
sameehj
committed
test(sbom): liboqs/bomsh CI coverage, macOS PATH fix, dep regressions
sameehj
committed
feat(sbom): standalone gen-sbom for embedded / RTOS builds
sameehj
committed
fix(sbom,ci): build liboqs from source; rewire bomsh for new layout
sameehj
committed
fix(sbom,ci): unbreak bomsh + liboqs(falcon) jobs; archive SBOMs
sameehj
committed
ci(sbom): drop non-ASCII '§' from sbom.yml comment (fix check-source-text)
sameehj
committed
test(sbom): expand coverage; CI hard-requires pcpp

MarkAtwood
authored and
sameehj
committed
fix(sbom): correctness fixes in gen-sbom

MarkAtwood
authored and
sameehj
committed
build(sbom): Makefile.am hygiene

MarkAtwood
authored and
sameehj
committed
ci(sbom): pin deps, harden token, partial-clone bomsh

MarkAtwood
authored and
sameehj
committed
docs(sbom): correct NTIA/SPDX claims; fix broken anchor

MarkAtwood
authored and
sameehj
committed
docs(sbom): align with project's formal security policy

MarkAtwood
authored and
sameehj
committed
fix(sbom): emit urn:uuid documentNamespace; validate override; drop unhosted wolfssl.com URLs
sameehj
committed
ci(sbom): verify bomsh provenance end-to-end; pyspdxtools-validate enriched SPDX
sameehj
committed
ci(sbom): split bomsh upload into provenance bundle + trace diagnostics
sameehj
committed
fix(sbom,ci): pin verifier check (C) to bomsh-traced gitoid; codespell
sameehj
committed
fix(bomsh): snapshot traced library before `make sbom`'s libtool relink
sameehj
committed
fix(bomsh): use bomsh_sbom.py -g to insert ArtifactID, not -f
sameehj
committed
fix(bomsh): drop verifier check (C) and _bomsh.artefact
sameehj
committed
sbom: gen-sbom output upgrades for auditor parity
sameehj
committed
sbom,bomsh: hash the bomsh-traced binary, fix doc/SBOM.md
sameehj
committed
sbom: standalone CI validators, ship bomsh_verify, gitignore outputs
sameehj
committed
advisory: gen-advisory CSAF 2.0 + CycloneDX VEX generator + make target
sameehj
committed
advisory: tests, CSAF mandatory-test gate, and CI
sameehj
committed

Commits on Jun 16, 2026

sbom: address Skoll review findings
sameehj
committed

Commits on Jun 17, 2026

ci: fix codespell, source-text, and SBOM check failures
sameehj
committed

Commits on Jun 18, 2026

ci: pin actions/clones to SHAs; fix CVE-5778 availability score
sameehj
committed

Commits on Jun 23, 2026

feat(sbom): add --srcs-file, --no-artifact-hash, and hash-source tag
sameehj
committed