wolfSSL 5.9.4 Introduces Automated SBOM Generation for CRA Compliance

wolfSSL 5.9.4 writes its own Software Bill of Materials. After a normal build, run:

./configure && make && make sbom

It needs python3 and pyspdxtools (pip install spdx-tools) installed before you run configure.

make sbom stages a private install, hashes the installed library, and reads the build macros from the configured header. It writes three files: wolfssl-.cdx.json (CycloneDX 1.6), wolfssl-.spdx.json (SPDX 2.3), and wolfssl-.spdx (SPDX tag-value). Each carries the version, supplier, license, the SHA-256 of the library, the CPE that matches National Vulnerability Database entries, a package URL, and the feature options you compiled in, so the SBOM matches the build you ship. pyspdxtools validates the SPDX, and make sbom stops with an error if it is invalid. SOURCE_DATE_EPOCH makes the SBOM byte-identical for identical builds.

Many embedded products compile wolfSSL sources straight into firmware and never run ./configure. For those builds, scripts/gen-sbom reads your user_settings.h (via pcpp) and the list of source files you compile. With no separate library to hash, it computes a Merkle hash of OmniBOR gitoids over those sources, a value an auditor can recompute from the public tree.

Commercial licensees regenerate the SBOM with their license text by setting SBOM_LICENSE_OVERRIDE=LicenseRef-wolfSSL-Commercial and SBOM_LICENSE_TEXT to the license file.

CRA vulnerability reporting obligations have applied since September 11, 2026. The rest of the regulation, including conformity assessment and CE marking, applies from December 11, 2027. Annex I, Part II requires manufacturers to draw up an SBOM. That duty starts on December 11, 2027. Market surveillance authorities can request the SBOM. An SBOM does not make a product compliant by itself. Vulnerability handling and updates stay your responsibility.

Recipes for Make, CMake, Zephyr, ESP-IDF, STM32CubeIDE, IAR and Keil are in doc/SBOM.md. How to reference wolfSSL from your product SBOM in SPDX or CycloneDX is in doc/CRA.md. For build provenance, see our companion post on make bomsh.

Learn how wolfSSL can help simplify SBOM generation and support your Cyber Resilience Act compliance efforts. For more information, contact us at facts@wolfssl.com or +1 425 245 8247.

Download wolfSSL Now