Skip to content

fix(sbom.am): capture build macros with host cc, not cross $(CC) #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MarkAtwood wants to merge 1 commit into
base: fix/autotools-gen-sbom-discovery
Choose a base branch
from
Open

fix(sbom.am): capture build macros with host cc, not cross $(CC) #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions share/sbom.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@
# captured (e.g. wolfEngine: $(abs_builddir)/include/config.h;
# wolfCLU: $(abs_builddir)/src/config.h).
# Default: $(abs_builddir)/config.h.
# SBOM_HOSTCC Host C compiler used to expand the build macros (the
# -D/-U/-I tokens only, never the configured cross $(CC)),
# so the SBOM is byte-reproducible across toolchains.
# Default: cc.
#
# The wolfSSL/OpenSSL dependency flags are feature-detected against gen-sbom
# --help, so a product wired for them still produces a valid SBOM (with a NOTE)
Expand All @@ -69,6 +73,13 @@ SBOM_BIN_NAME ?= $(SBOM_PKGNAME)
SBOM_DEP_WOLFSSL ?= no
SBOM_DEP_OPENSSL ?= no
SBOM_CONFIG_H ?= $(abs_builddir)/config.h
# Host C compiler used to capture the build macros (matching the Make/CMake
# paths' HOSTCC), NOT the configured $(CC): on a cross build $(CC) would bake
# the cross compiler's target-specific predefined macros into the SBOM, so the
# same product built through a different toolchain would produce a different
# document. Only the -D/-U/-I tokens are fed to it (see the capture below), so
# it never sees target arch flags it cannot parse.
SBOM_HOSTCC ?= cc
Comment on lines +78 to +82
# Directory the wolfGlass tooling (gen-sbom) is vendored into. Products that
# vendor elsewhere override this (or SBOM_GEN directly).
SBOM_VENDOR_DIR ?= $(srcdir)/tools/sbom
Expand Down Expand Up @@ -109,9 +120,11 @@ CLEANFILES += $(SBOM_CDX) $(SBOM_SPDX) $(SBOM_SPDX_TV)

# Stage a `make install` into a private tree, discover the installed artifact
# (shared/static library or program; ELF/Mach-O/PE), hash it, capture the
# configured build macros (from SBOM_OPTIONS_H if set, else AM_CPPFLAGS/
# AM_CFLAGS/CFLAGS + config.h; some products carry their feature -D flags in
# AM_CFLAGS rather than AM_CPPFLAGS, and some outside config.h entirely),
# configured build macros (from SBOM_OPTIONS_H if set, else the -D/-U/-I tokens
# of AM_CPPFLAGS/AM_CFLAGS/CFLAGS + config.h, expanded through the HOST compiler
# SBOM_HOSTCC so the SBOM is reproducible across cross toolchains; some products
# carry their feature -D flags in AM_CFLAGS rather than AM_CPPFLAGS, and some
# outside config.h entirely),
# generate SPDX+CDX, validate
# the SPDX, then convert to tag-value. The staging tree and temp defines file
# are removed unconditionally via `trap`, even on failure. SOURCE_DATE_EPOCH is
Expand Down Expand Up @@ -157,8 +170,11 @@ sbom:
opts_h="$(SBOM_OPTIONS_H)"; \
if test -z "$$opts_h"; then \
opts_h="$$_defines"; \
$(CC) -dM -E $(DEFAULT_INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
$(AM_CFLAGS) $(CFLAGS) \
sbom_cpp=""; \
for f in $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS); do \
case "$$f" in -D*|-U*|-I*) sbom_cpp="$$sbom_cpp $$f";; esac; \
done; \
Comment on lines +173 to +176
$(SBOM_HOSTCC) -dM -E $(DEFAULT_INCLUDES) $$sbom_cpp \
$(if $(wildcard $(SBOM_CONFIG_H)),-include $(SBOM_CONFIG_H)) \
-x c /dev/null > "$$_defines"; \
fi; \
Expand Down
Loading