An SBOM says which wolfSSL you ship. make bomsh shows how that binary was built.
Install python3, pyspdxtools (pip install spdx-tools), bomtrace3, and bomsh_create_bom.py before you run configure. configure records their paths. bomsh_sbom.py is optional.
./configure && make bomsh
The target does a clean rebuild of wolfSSL under bomtrace3, a patched strace from the OmniBOR Bomsh project. It records every compiler input and output, and bomsh_create_bom.py turns the trace into a content-addressed OmniBOR graph from the built library back to each source file that produced it. bomtrace3 runs in user space through ptrace(). It needs no kernel patch, and the traced build takes about 1.2 times as long as a normal one.
You get three things:
- omnibor/, the graph objects and Bomsh metadata
- the usual SPDX and CycloneDX SBOM files, generated from the exact library Bomsh traced, so the SBOM checksum and the graph describe one binary
- omnibor.wolfssl-
.spdx.json, the SPDX file with an OmniBOR gitoid reference added, when bomsh_sbom.py is installed
The gitoid in that SPDX reference identifies the input manifest of the build, not the library file. A check that compares it to the library’s hash will fail, and that is expected. The link to the binary is the SHA-256 in the SBOM checksum field.
With bomsh_sbom.py installed, run this from the directory that contains omnibor/ and omnibor.wolfssl-
python3 scripts/bomsh_verify.py
It confirms that every gitoid in the SPDX file resolves to an object in omnibor/ and that every object matches its hash, so a corrupt or truncated object fails. wolfSSL CI runs the same checks.
For most Cyber Resilience Act paperwork the SBOM is enough. Add the OmniBOR graph when an assessor wants evidence of the build itself. make bomsh needs a Linux build host. Cross-compilers work, and the target device can run any OS. It will not run where ptrace is blocked, such as a container with a hardened seccomp profile or a host with kernel.yama.ptrace_scope=3. Setup steps for bomtrace3 are in doc/SBOM.md.
Learn how wolfSSL can help strengthen software supply chain security with verifiable build provenance and SBOM generation. For more information on OmniBOR integration and Cyber Resilience Act readiness, contact us at facts@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now