Generate a wolfBoot SBOM for Make, CMake, IAR, and Zephyr

    • wolfBoot can write a CycloneDX 1.6 SBOM and an SPDX 2.3 SBOM for the bootloader image that you configure. wolfBoot builds in many ways, and one engine serves all of them: the shared wolfssl-compliance-tooling, vendored under tools/sbom/.

    An SBOM helps a manufacturer document the software in a product under the EU Cyber Resilience Act. It does not by itself make the product compliant.

    You need Python 3 and a host C compiler. The default is cc. Set HOSTCC to use another one.

    Capture the full configuration

    wolfBoot configuration is derived. include/user_settings.h turns a choice such as WOLFBOOT_SIGN_ECC256 into HAVE_ECC, HAVE_ECC256, and more. The SBOM capture reads the real settings header with the real -D and -I flags:

    cc -dM -E  -include wolfssl/wolfcrypt/settings.h

    If only the flags or only the header were used, the file would describe a bootloader that was never built. The capture stops instead.

    Run it in the tree you ship from

    src/keystore.c is generated from the signing key. On a fresh tree, make sbom creates it, and also creates a new signing key if none exists.

    Warning: Run make sbom in the tree that built the shipped image, with the same signing key. Otherwise the source-set hash does not match the image you ship.

    Four routes

    Make (also MCUXpresso, STM32Cube, PSoC 6, Freedom-E, and Vorago). TARGET, SIGN, and HASH must match the image you ship:

    make sbom TARGET= SIGN= HASH=

    CMake:

    cmake -S . -B build-sim -DWOLFBOOT_TARGET=sim
cmake --build build-sim --target sbom

    IAR Embedded Workbench. Read the project file:

    python3 tools/sbom/frontends/iar_sbom.py IDE/IAR/wolfboot.ewp \
    --name wolfboot \
    --driver tools/sbom/sbom-driver \
    --version-file include/wolfboot/version.h \
    --version-macro LIBWOLFBOOT_VERSION_STRING

    Compilation database (Pico SDK, IDE builds). Make one with -DCMAKE_EXPORT_COMPILE_COMMANDS=ON or bear — make, then:

    python3 tools/sbom/frontends/compdb_sbom.py compile_commands.json \
    --name wolfboot \
    --driver tools/sbom/sbom-driver \
    --version-file include/wolfboot/version.h \
    --version-macro LIBWOLFBOOT_VERSION_STRING

    TI CCS, MPLAB X, Renesas RX, and Xilinx Zynq targets can go through Make with tools/scripts/ide-sbom/route_through_sbom.sh. The commands for each board are in docs/SBOM.md. On Windows, use WSL, MSYS, or Git Bash, or call tools/sbom/sbom-driver.py.

    Output

    The file name includes the target and algorithms, because one wolfBoot version covers many images:

    wolfboot----.cdx.json
wolfboot----.spdx.json

    Check the files:

    python3 tools/sbom/validate_sbom.py --name-prefix wolfboot \
    wolfboot-*.cdx.json wolfboot-*.spdx.json

    wolfSSL inside the bootloader

    wolfCrypt is compiled into the image. The SBOM records it as a wolfcrypt component inside a wolfssl component, with these identifiers:

    • wolfSSL CPE: cpe:2.3:a:wolfssl:wolfssl::*:*:*:*:*:*:*
    • wolfSSL package URL: pkg:github/wolfssl/wolfssl@v-stable
    • wolfCrypt package URL: pkg:github/wolfssl/wolfssl@v-stable#wolfcrypt
    • wolfBoot CPE: cpe:2.3:a:wolfssl:wolfboot::*:*:*:*:*:*:*

    Almost every wolfBoot configuration defines WOLFCRYPT_ONLY, so the image has no TLS code. The SBOM records this:

    wolfssl:sbom:wolfssl-subset=wolfcrypt-only

    The wolfssl component stays in the document, so scanners still match crypto advisories. A scanner can also report a TLS advisory against it. For that case, record a VEX statement of not_affected with justification code_not_present. Our advisory post explains how.

    Limits

    • The SBOM lists sources on disk. A vendor SDK outside the tree is absent, and the compiler runtime is not a component.
    • Only wolfSSL is a separate dependency component. wolfTPM, wolfPKCS11, wolfHSM, wolfPSA, and wolfHAL sources are part of the wolfBoot source set.
    • The document records one hash for the source set, not one per file.
    • If an object file has no source, make sbom stops. Run git submodule update –init, or set SBOM_ALLOW_MISSING=1 to accept a partial document.

    Other artifacts

    To publish the HAL as its own component:

    make sbom-hal TARGET= SIGN=

    The zephyr/ directory is a Zephyr module. Use tools/sbom/frontends/zephyr_sbom.py, or point compdb_sbom.py at a west build’s compile_commands.json. See docs/SBOM.md.

    Set SOURCE_DATE_EPOCH when you need byte-identical files.

    If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

    Download wolfSSL Now