# includes append to these: SUFFIXES = TESTS = CLEANFILES = DISTCLEANFILES = MAINTAINERCLEANFILES = bin_PROGRAMS = noinst_HEADERS = lib_LTLIBRARIES = man_MANS = noinst_LTLIBRARIES = noinst_PROGRAMS = include_HEADERS = nobase_include_HEADERS = check_PROGRAMS = EXTRA_HEADERS = BUILT_SOURCES= EXTRA_DIST= dist_doc_DATA= dist_noinst_SCRIPTS = noinst_SCRIPTS = check_SCRIPTS = noinst_DATA = ignore_files = SUBDIRS_OPT = DIST_SUBDIRS_OPT = # Serialize the build when Intel QuickAssist is enabled. Concurrent QAT user # processes (the parallel test binaries that `make -j check` launches) exhaust # the device's crypto instances and usdm contiguous memory, so the test phase # must run serially. With the non-recursive build this disables -j for the # whole invocation, which also matches the QAT driver's build guidance. if BUILD_INTEL_QA .NOTPARALLEL: endif if BUILD_INTEL_QA_SYNC .NOTPARALLEL: endif # allow supplementary or override flags to be passed at make time: AM_CPPFLAGS += $(EXTRA_CPPFLAGS) AM_CFLAGS += $(EXTRA_CFLAGS) AM_CCASFLAGS += $(EXTRA_CCASFLAGS) AM_LDFLAGS += $(EXTRA_LDFLAGS) #includes additional rules from aminclude.am @INC_AMINCLUDE@ DISTCLEANFILES+= aminclude.am \ .build_params CLEANFILES+= ecc-key.der \ ecc-public-key.der \ cert.der \ cert.pem \ certecc.der \ certecc.pem \ certreq.der \ certreq.pem \ key.der \ key.pem \ ecc-key-pkcs8.der \ othercert.der \ othercert.pem \ pkcs7cert.der \ pkcs7authEnvelopedDataAES128GCM.der \ pkcs7authEnvelopedDataAES128GCM_ECDH_SHA1KDF.der \ pkcs7authEnvelopedDataAES128GCM_KEKRI.der \ pkcs7authEnvelopedDataAES128GCM_ORI.der \ pkcs7authEnvelopedDataAES128GCM_PWRI.der \ pkcs7authEnvelopedDataAES192GCM.der \ pkcs7authEnvelopedDataAES256GCM.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA256KDF.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA256KDF_authAttribs.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA256KDF_bothAttribs.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA256KDF_fw_bothAttribs.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA256KDF_unauthAttribs.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA512KDF.der \ pkcs7authEnvelopedDataAES256GCM_ECDH_SHA512KDF_ukm.der \ pkcs7authEnvelopedDataAES256GCM_firmwarePkgData.der \ pkcs7authEnvelopedDataAES256GCM_IANDS.der \ pkcs7authEnvelopedDataAES256GCM_SKID.der \ pkcs7compressedData_data_zlib.der \ pkcs7compressedData_firmwarePkgData_zlib.der \ pkcs7encryptedDataAES128CBC.der \ pkcs7encryptedDataAES192CBC.der \ pkcs7encryptedDataAES256CBC_attribs.der \ pkcs7encryptedDataAES256CBC.der \ pkcs7encryptedDataAES256CBC_firmwarePkgData.der \ pkcs7encryptedDataAES256CBC_multi_attribs.der \ pkcs7encryptedDataDES3.der \ pkcs7encryptedDataDES.der \ pkcs7envelopedDataAES256CBC_ECDH.der \ cmake/wolfssl-config.cmake \ cmake/wolfssl-config-version.cmake \ cmake/wolfssl-targets.cmake \ pkcs7envelopedDataAES128CBC_ECDH_SHA1KDF.der \ pkcs7envelopedDataAES256CBC_ECDH_SHA256KDF.der \ pkcs7envelopedDataAES256CBC_ECDH_SHA512KDF.der \ pkcs7envelopedDataAES256CBC_ECDH_SHA512KDF_ukm.der \ pkcs7envelopedDataDES3.der \ pkcs7envelopedDataAES128CBC.der \ pkcs7envelopedDataAES128CBC_KEKRI.der \ pkcs7envelopedDataAES128CBC_PWRI.der \ pkcs7envelopedDataAES128CBC_ORI.der \ pkcs7envelopedDataAES192CBC.der \ pkcs7envelopedDataAES256CBC.der \ pkcs7envelopedDataAES256CBC_IANDS.der \ pkcs7envelopedDataAES256CBC_SKID.der \ pkcs7signedData_RSA_SHA.der \ pkcs7signedData_RSA_SHA_noattr.der \ pkcs7signedData_RSA_SHA224.der \ pkcs7signedData_RSA_SHA256.der \ pkcs7signedData_RSA_SHA256_firmwarePkgData.der \ pkcs7signedData_RSA_SHA256_custom_contentType.der \ pkcs7signedData_RSA_SHA256_with_ca_cert.der \ pkcs7signedData_RSA_SHA256_SKID.der \ pkcs7signedData_RSA_SHA256_detachedSig.der \ pkcs7signedData_RSA_SHA384.der \ pkcs7signedData_RSA_SHA512.der \ pkcs7signedData_ECDSA_SHA.der \ pkcs7signedData_ECDSA_SHA_noattr.der \ pkcs7signedData_ECDSA_SHA224.der \ pkcs7signedData_ECDSA_SHA256.der \ pkcs7signedData_ECDSA_SHA256_firmwarePkgData.der \ pkcs7signedData_ECDSA_SHA256_custom_contentType.der \ pkcs7signedData_ECDSA_SHA256_SKID.der \ pkcs7signedData_ECDSA_SHA384.der \ pkcs7signedData_ECDSA_SHA512.der \ pkcs7signedFirmwarePkgData_ECDSA_SHA256.der \ pkcs7signedFirmwarePkgData_ECDSA_SHA256_SKID.der \ pkcs7signedFirmwarePkgData_ECDSA_SHA256_noattr.der \ pkcs7signedFirmwarePkgData_RSA_SHA256.der \ pkcs7signedFirmwarePkgData_RSA_SHA256_SKID.der \ pkcs7signedFirmwarePkgData_RSA_SHA256_noattr.der \ pkcs7signedFirmwarePkgData_RSA_SHA256_with_ca_cert.der \ pkcs7signedCompressedFirmwarePkgData_ECDSA_SHA256.der \ pkcs7signedCompressedFirmwarePkgData_ECDSA_SHA256_noattr.der \ pkcs7signedCompressedFirmwarePkgData_RSA_SHA256.der \ pkcs7signedCompressedFirmwarePkgData_RSA_SHA256_noattr.der \ pkcs7signedEncryptedFirmwarePkgData_RSA_SHA256.der \ pkcs7signedEncryptedFirmwarePkgData_RSA_SHA256_noattr.der \ pkcs7signedEncryptedFirmwarePkgData_ECDSA_SHA256.der \ pkcs7signedEncryptedFirmwarePkgData_ECDSA_SHA256_noattr.der \ pkcs7signedEncryptedCompressedFirmwarePkgData_ECDSA_SHA256.der \ pkcs7signedEncryptedCompressedFirmwarePkgData_ECDSA_SHA256_noattr.der \ pkcs7signedEncryptedCompressedFirmwarePkgData_RSA_SHA256.der \ pkcs7signedEncryptedCompressedFirmwarePkgData_RSA_SHA256_noattr.der \ tests/test-log-dump-to-file.txt \ tests/bio_write_test.txt \ tests/cert_cache.tmp \ certeccrsa.der \ certeccrsa.pem \ ecc-key.pem \ test-write-dhparams.pem \ MyKeyLog.txt exampledir = $(docdir)/example dist_example_DATA= ACLOCAL_AMFLAGS= -I m4 EXTRA_DIST+= .cyignore EXTRA_DIST+= wolfssl.vcproj EXTRA_DIST+= wolfssl.vcxproj EXTRA_DIST+= wolfssl-VS2022.vcxproj EXTRA_DIST+= wolfssl64.sln EXTRA_DIST+= valgrind-error.sh EXTRA_DIST+= valgrind-bash.supp EXTRA_DIST+= fips-hash.sh EXTRA_DIST+= fips-hash-offline.sh EXTRA_DIST+= .github/scripts/check-source-text.sh EXTRA_DIST+= gencertbuf.pl EXTRA_DIST+= README.md EXTRA_DIST+= README-async.md EXTRA_DIST+= README EXTRA_DIST+= ChangeLog.md EXTRA_DIST+= LICENSING EXTRA_DIST+= INSTALL EXTRA_DIST+= LPCExpresso.cproject EXTRA_DIST+= LPCExpresso.project EXTRA_DIST+= resource.h wolfssl.rc EXTRA_DIST+= CMakeLists.txt EXTRA_DIST+= CMakePresets.json EXTRA_DIST+= CMakeSettings.json EXTRA_DIST+= m4/ax_atomic.m4 include cmake/include.am include wrapper/include.am include wolfssl/include.am include certs/include.am include doc/include.am include Docker/include.am include src/include.am include support/include.am include wolfcrypt/benchmark/include.am include wolfcrypt/src/include.am include wolfcrypt/test/include.am include examples/include.am include testsuite/include.am include tests/include.am include sslSniffer/sslSnifferTest/include.am include debian/include.am include rpm/include.am include linuxkm/include.am include bsdkm/include.am include zephyr/include.am include RTOS/nuttx/include.am # Exclude references to non-DFSG sources from build files if !BUILD_DISTRO include mqx/util_lib/Sources/include.am include mqx/wolfcrypt_benchmark/Sources/include.am include mqx/wolfcrypt_test/Sources/include.am include mqx/wolfssl/include.am include mqx/wolfssl_client/Sources/include.am include mplabx/include.am include mplabx/wolfcrypt_benchmark.X/nbproject/include.am include mplabx/wolfcrypt_test.X/nbproject/include.am include mplabx/wolfssl.X/nbproject/include.am include mcapi/include.am include mcapi/wolfcrypt_mcapi.X/nbproject/include.am include mcapi/wolfcrypt_test.X/nbproject/include.am include mcapi/wolfssl.X/nbproject/include.am include mcapi/zlib.X/nbproject/include.am include tirtos/include.am include IDE/include.am endif include scripts/include.am if BUILD_LINUXKM # rather than setting $SUBDIRS here directly, we set an auxiliary variable. # autotools sees the SUBDIRS assignment here even if BUILD_LINUXKM is false, # at least for purposes of recursing for "make distdir", which we don't want to happen. SUBDIRS_OPT += linuxkm DIST_SUBDIRS_OPT += linuxkm export build_triplet host_triplet CC AS LD \ KERNEL_ROOT KERNEL_ARCH KERNEL_EXTRA_CFLAGS \ EXTRA_CFLAGS EXTRA_CPPFLAGS EXTRA_CCASFLAGS EXTRA_LDFLAGS \ AM_CPPFLAGS CPPFLAGS AM_CFLAGS CFLAGS \ AM_CCASFLAGS CCASFLAGS \ src_libwolfssl_la_OBJECTS ENABLED_CRYPT_TESTS ENABLED_LINUXKM_LKCAPI_REGISTER \ ENABLED_LINUXKM_PIE ENABLED_ASM \ CFLAGS_FPU_DISABLE CFLAGS_FPU_ENABLE CFLAGS_SIMD_DISABLE CFLAGS_SIMD_ENABLE \ CFLAGS_AUTO_VECTORIZE_DISABLE CFLAGS_AUTO_VECTORIZE_ENABLE \ ASFLAGS_FPU_DISABLE_SIMD_ENABLE ASFLAGS_FPU_ENABLE_SIMD_DISABLE \ ASFLAGS_FPUSIMD_DISABLE ASFLAGS_FPUSIMD_ENABLE ENABLED_KERNEL_BENCHMARKS \ FIPS_FLAVOR HAVE_FIPS_VERSION_MAJOR HAVE_FIPS_VERSION_MINOR \ HAVE_FIPS_VERSION_PATCH module: +$(MAKE) -C linuxkm module module-update-fips-hash: +$(MAKE) -C linuxkm module-update-fips-hash module-with-matching-fips-hash: +$(MAKE) -C linuxkm module-with-matching-fips-hash module-with-matching-fips-hash-no-sign: +$(MAKE) -C linuxkm module-with-matching-fips-hash-no-sign clean_module: +$(MAKE) -C linuxkm clean install_module modules_install: +$(MAKE) -C linuxkm modules_install endif if BUILD_BSDKM SUBDIRS_OPT += bsdkm DIST_SUBDIRS_OPT += bsdkm .MAKE.EXPORTED = build_triplet host_triplet CC AS LD \ KERNEL_ROOT BSDKM_EXPORT_SYMS KERNEL_EXTRA_CFLAGS \ EXTRA_CFLAGS EXTRA_CPPFLAGS EXTRA_CCASFLAGS EXTRA_LDFLAGS \ AM_CPPFLAGS CPPFLAGS AM_CFLAGS CFLAGS \ AM_CCASFLAGS CCASFLAGS \ src_libwolfssl_la_OBJECTS ENABLED_CRYPT_TESTS ENABLED_BSDKM_REGISTER \ ENABLED_ASM ENABLED_INTELASM ENABLED_AESNI ENABLED_AESNI_WITH_AVX \ ENABLED_KERNEL_BENCHMARKS endif if USE_VALGRIND TESTS_ENVIRONMENT=./valgrind-error.sh endif TEST_EXTENSIONS=.test TESTS += $(check_PROGRAMS) check_SCRIPTS+= $(dist_noinst_SCRIPTS) TESTS += $(check_SCRIPTS) ############################################################################## # Out-of-tree ("VPATH") build support for "make check". # # The test programs (testsuite, tests/unit.test) and the example client and # server binaries, as well as the shell-script tests under scripts/, locate # their read-only inputs using paths relative to the working directory: # certificates under certs/, TLS test-configuration files under tests/, sniffer # captures and helpers under scripts/, and the top-level "input"/"quit" files. # ChangeToWolfRoot() (wolfssl/test.h) walks up from the working directory # looking for certs/dh2048.pem to anchor these relative paths. # # For an in-tree build that data is already present in the build directory, but # for an out-of-tree build it exists only in the source tree. Symlink it into # the build tree so the tests can find it. This is driven by a stamp file in # BUILT_SOURCES so it runs once, before anything else, for "make", "make all" # and "make check". It is a no-op for in-tree builds. # # The setup and the distclean cleanup use rm -rf: a --private-dir run of # .github/scripts/parallel-make-check.py replaces the certs symlink with a # private directory copy, which rm -f would not remove. The recipe body # runs under set -e so a failed symlink aborts the build instead of being # stamped complete. ############################################################################## BUILT_SOURCES += wolfssl-test-data.stamp wolfssl-test-data.stamp: $(AM_V_at)set -e; \ if test "$(abs_top_srcdir)" != "$(abs_top_builddir)"; then \ $(MKDIR_P) tests scripts examples; \ for f in certs input quit; do \ rm -rf "$$f"; \ $(LN_S) "$(abs_top_srcdir)/$$f" "$$f"; \ done; \ rm -f examples/crypto_policies; \ $(LN_S) "$(abs_top_srcdir)/examples/crypto_policies" \ examples/crypto_policies; \ for f in "$(abs_top_srcdir)"/tests/*.conf \ "$(abs_top_srcdir)"/tests/*.cnf \ "$(abs_top_srcdir)"/tests/TXT_DB.txt; do \ test -e "$$f" || continue; \ b=`basename "$$f"`; \ rm -f "tests/$$b"; \ $(LN_S) "$$f" "tests/$$b"; \ done; \ for f in "$(abs_top_srcdir)"/scripts/*.pcap \ "$(abs_top_srcdir)"/scripts/*.out \ "$(abs_top_srcdir)"/scripts/*.sslkeylog \ "$(abs_top_srcdir)"/scripts/multi-msg-record.py; do \ test -e "$$f" || continue; \ b=`basename "$$f"`; \ rm -f "scripts/$$b"; \ $(LN_S) "$$f" "scripts/$$b"; \ done; \ fi $(AM_V_at)touch $@ DISTCLEANFILES += wolfssl-test-data.stamp # Local clean: doc build artefacts plus the generated SBOM/advisory/OmniBOR # outputs. Consolidated here (automake allows a single clean-local) so the # OmniBOR graph (omnibor/) and advisory documents (advisories/out/) are cleaned # alongside the other top-level build products rather than from doc/include.am. clean-local: -rm -rf doc/build/ -rm -rf doc/html/ -rm -f doc/refman.pdf -rm -f doc/doxygen_warnings -rm -rf $(BOMSH_OMNIBORDIR) -rm -rf $(ADVISORY_OUT_DIR) # Remove the symlinks created for out-of-tree builds. Gated on # srcdir != builddir so an in-tree build never touches the real source files. distclean-local: $(AM_V_at)if test "$(abs_top_srcdir)" != "$(abs_top_builddir)"; then \ rm -rf certs input quit; \ rm -f tests/*.conf tests/*.cnf tests/TXT_DB.txt; \ rm -f scripts/*.pcap scripts/*.out scripts/*.sslkeylog \ scripts/multi-msg-record.py; \ rm -f examples/crypto_policies; \ fi test: check @BUILD_EXAMPLE_SERVERS_TRUE@tests/unit.log: testsuite/testsuite.log @BUILD_EXAMPLE_SERVERS_TRUE@scripts/unit.log: testsuite/testsuite.log DISTCLEANFILES+= wolfssl-config MAINTAINERCLEANFILES+= wolfssl/wolfcrypt/async.h MAINTAINERCLEANFILES+= wolfssl/wolfcrypt/fips.h MAINTAINERCLEANFILES+= wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h MAINTAINERCLEANFILES+= wolfssl/wolfcrypt/port/intel/quickassist.h MAINTAINERCLEANFILES+= wolfssl/wolfcrypt/port/intel/quickassist_mem.h SUBDIRS=$(SUBDIRS_OPT) DIST_SUBDIRS=$(DIST_SUBDIRS_OPT) maintainer-clean-local: -rm Makefile.in -rm aclocal.m4 -rm build-aux/compile -rm build-aux/config.guess -rm build-aux/config.sub -rm build-aux/depcomp -rm build-aux/install-sh -rm build-aux/ltmain.sh -rm build-aux/missing -rmdir build-aux -rm configure -rm config.log -rm config.status -rm config.in -rm m4/libtool.m4 -rm m4/ltoptions.m4 -rm m4/ltsugar.m4 -rm m4/ltversion.m4 -rm m4/lt~obsolete.m4 -rm support/wolfssl.pc find . -type f -name '*~' -exec rm -f '{}' \; -rm -f @PACKAGE@-*.tar.gz -rm -f @PACKAGE@-*.rpm # !!!! first line of rule has to start with a hard (real) tab, not spaces egs: $(MAKE) examples/client/client; \ $(MAKE) examples/echoclient/echoclient;\ $(MAKE) examples/server/server; \ $(MAKE) examples/echoserver/echoserver; wc_egs: $(MAKE) wolfcrypt/test/testwolfcrypt; \ $(MAKE) wolfcrypt/benchmark/benchmark; install-exec-local: install-generic-config install-generic-config: $(mkinstalldirs) $(DESTDIR)$(bindir) $(INSTALL_SCRIPT) @GENERIC_CONFIG@ $(DESTDIR)$(bindir) uninstall-local: -rm -f $(DESTDIR)$(bindir)/@GENERIC_CONFIG@ merge-clean: @find ./ | $(GREP) \.gcda | xargs rm -f @find ./ | $(GREP) \.gcno | xargs rm -f @find ./ | $(GREP) \.gz | xargs rm -f @find ./ | $(GREP) \.orig | xargs rm -f @find ./ | $(GREP) \.rej | xargs rm -f @find ./ | $(GREP) \.rpm | xargs rm -f @find ./ | $(GREP) \.THIS | xargs rm -f @find ./ | $(GREP) \.OTHER | xargs rm -f @find ./ | $(GREP) \.BASE | xargs rm -f @find ./ | $(GREP) \~$$ | xargs rm -f %.o: %.cu $(NVCC) -dc $(CUDAFLAGS) -o $@ $< .cu.lo: $(LIBTOOL) --tag=CC --mode=compile $(COMPILE) --compile -o $@ $< -static # SBOM generation (CRA compliance) SBOM_CDX = wolfssl-$(PACKAGE_VERSION).cdx.json SBOM_SPDX = wolfssl-$(PACKAGE_VERSION).spdx.json SBOM_SPDX_TV = wolfssl-$(PACKAGE_VERSION).spdx # Use Automake's $(docdir) so a user's --docdir override is honoured (this # equals $(datadir)/doc/$(PACKAGE) by default). sbomdir = $(docdir) # Shared-library / Mach-O basenames in priority order (versioned first). # Both `sbom:` and `bomsh:` glob for these under their own search prefixes; # adding a new platform-specific dynamic-library extension here updates # both targets at once. Static (.a) and Windows (.dll/.lib) variants are # listed inline at each call-site because their ordering and prefixes # differ between the install tree and the build tree. WOLFSSL_LIB_DSO_BASENAMES = \ libwolfssl.so.[0-9]* \ libwolfssl.so \ libwolfssl.[0-9]*.dylib \ libwolfssl.dylib .PHONY: sbom install-sbom uninstall-sbom # Stage a `make install` into a private tree, discover the installed library # artifact (shared or static, ELF/Mach-O/PE), hash it, generate SPDX+CDX, # validate the SPDX, then convert to tag-value. The staging tree is removed # unconditionally via `trap`, even if any step fails. Honors SOURCE_DATE_EPOCH # for reproducible builds (set by the recipe to `git log -1 --format=%ct` when # unset and a git tree is available). # # User-overridable variables: # SBOM_LICENSE_OVERRIDE SPDX expression to use instead of the GPL ID # parsed from LICENSING (e.g. for commercial # licensees: LicenseRef-wolfSSL-Commercial). # SBOM_LICENSE_TEXT Path to the actual licence text for any # LicenseRef-* in SBOM_LICENSE_OVERRIDE. Required # for SPDX 2.3 conformance whenever a custom # LicenseRef is in use; `make sbom` exits with an # error if it is missing. # SBOM_DOCUMENT_NAMESPACE Override the SPDX documentNamespace. Default # is a deterministic urn:uuid (SPDX 2.3 sec. 6.5 # requires only uniqueness, not resolvability). # Downstream packagers re-hosting the SBOM under # their own URL should set this to a URI they # actually serve (e.g. # https://example.com/sbom/wolfssl-X.Y.Z.spdx.json). # SBOM_DEP_VERSIONS Space-separated KEY=VERSION list forwarded to # gen-sbom as repeated --dep-version flags (KEY is # one of the known deps, e.g. libz / openssl). Use # this on build/packaging hosts that lack the dep's # pkg-config .pc file, where version detection would # otherwise fall back to NOASSERTION (SPDX) / an # omitted version+purl (CycloneDX). Example: # make sbom SBOM_DEP_VERSIONS='libz=1.3.1 openssl=3.5.0'. # SBOM_LIB_OVERRIDE Absolute path to the library artefact whose # SHA-256 should land in the SBOM, INSTEAD of # discovering one via a private staging install. # Set by `make bomsh` so the SBOM hash and the # OmniBOR enrichment refer to the SAME bomsh- # traced binary; without this override `make # sbom` would re-link via `make install` and # hash a different artefact than `bomsh_sbom.py` # fingerprints, leaving the SHA-256 in # `checksums[]` and the gitoid in `externalRefs` # describing two unrelated files. sbom: @if test -z "$(PYTHON3)"; then \ echo ""; \ echo "ERROR: 'python3' not found in PATH. Cannot generate SBOM."; \ echo ""; \ exit 1; \ fi @if test -z "$(PYSPDXTOOLS)"; then \ echo ""; \ echo "ERROR: 'pyspdxtools' not found in PATH. Cannot validate SBOM."; \ echo " Install: pip install spdx-tools"; \ echo ""; \ exit 1; \ fi @rm -rf $(abs_builddir)/_sbom_staging @set -e; \ trap 'rm -rf $(abs_builddir)/_sbom_staging' EXIT INT TERM HUP; \ if test -n "$(SBOM_LIB_OVERRIDE)"; then \ if test ! -f "$(SBOM_LIB_OVERRIDE)"; then \ echo ""; \ echo "ERROR: SBOM_LIB_OVERRIDE=$(SBOM_LIB_OVERRIDE) does not exist."; \ echo ""; \ exit 1; \ fi; \ sbom_lib="$(SBOM_LIB_OVERRIDE)"; \ else \ $(MAKE) install DESTDIR=$(abs_builddir)/_sbom_staging; \ sbom_lib=""; \ for lib in \ $(addprefix "$(abs_builddir)/_sbom_staging$(libdir)"/,$(WOLFSSL_LIB_DSO_BASENAMES)) \ "$(abs_builddir)/_sbom_staging$(libdir)"/libwolfssl.dll \ "$(abs_builddir)/_sbom_staging$(libdir)"/libwolfssl.dll.a \ "$(abs_builddir)/_sbom_staging$(libdir)"/libwolfssl.lib \ "$(abs_builddir)/_sbom_staging$(libdir)"/wolfssl.lib \ "$(abs_builddir)/_sbom_staging$(libdir)"/libwolfssl.a; do \ if test -f "$$lib"; then sbom_lib="$$lib"; break; fi; \ done; \ if test -z "$$sbom_lib"; then \ echo ""; \ echo "ERROR: No installed wolfSSL library artifact found for SBOM."; \ echo " Searched in $(abs_builddir)/_sbom_staging$(libdir)"; \ echo " (configure with --enable-shared or --enable-static)"; \ echo ""; \ exit 1; \ fi; \ fi; \ echo "SBOM: hashing $$sbom_lib"; \ if test -z "$${SOURCE_DATE_EPOCH:-}" && test -n "$(GIT)" && \ $(GIT) -C "$(srcdir)" rev-parse --git-dir >/dev/null 2>&1; then \ sde=`$(GIT) -C "$(srcdir)" log -1 --format=%ct 2>/dev/null`; \ if test -n "$$sde"; then \ SOURCE_DATE_EPOCH="$$sde"; \ export SOURCE_DATE_EPOCH; \ fi; \ fi; \ $(PYTHON3) $(srcdir)/scripts/gen-sbom \ --name $(PACKAGE) \ --version $(PACKAGE_VERSION) \ --license-file $(srcdir)/LICENSING \ $(if $(SBOM_LICENSE_OVERRIDE),--license-override '$(SBOM_LICENSE_OVERRIDE)') \ $(if $(SBOM_LICENSE_TEXT),--license-text '$(SBOM_LICENSE_TEXT)') \ $(if $(SBOM_DOCUMENT_NAMESPACE),--document-namespace '$(SBOM_DOCUMENT_NAMESPACE)') \ --options-h $(abs_builddir)/wolfssl/options.h \ --lib "$$sbom_lib" \ --dep-libz "$(ENABLED_LIBZ)" \ $(foreach dv,$(SBOM_DEP_VERSIONS),--dep-version '$(dv)') \ --cdx-out $(abs_builddir)/$(SBOM_CDX) \ --spdx-out $(abs_builddir)/$(SBOM_SPDX); \ $(PYSPDXTOOLS) --infile $(abs_builddir)/$(SBOM_SPDX) \ --outfile $(abs_builddir)/$(SBOM_SPDX_TV) install-sbom: sbom $(MKDIR_P) $(DESTDIR)$(sbomdir) $(INSTALL_DATA) $(SBOM_CDX) $(DESTDIR)$(sbomdir)/ $(INSTALL_DATA) $(SBOM_SPDX) $(DESTDIR)$(sbomdir)/ $(INSTALL_DATA) $(SBOM_SPDX_TV) $(DESTDIR)$(sbomdir)/ uninstall-sbom: -rm -f $(DESTDIR)$(sbomdir)/$(SBOM_CDX) -rm -f $(DESTDIR)$(sbomdir)/$(SBOM_SPDX) -rm -f $(DESTDIR)$(sbomdir)/$(SBOM_SPDX_TV) CLEANFILES += $(SBOM_CDX) $(SBOM_SPDX) $(SBOM_SPDX_TV) # Security advisory generation (CSAF 2.0 + CycloneDX 1.6 VEX) # # `make advisory` is a thin wrapper around scripts/gen-advisory: it feeds the # script the canonical advisory single-source-of-truth under advisories/ and is # byte-for-byte interchangeable with running the script by hand. Equivalent # invocations: # # make advisory # python3 scripts/gen-advisory # uses the same defaults # python3 scripts/gen-advisory \ # --records-dir advisories/records \ # --vex-overlay advisories/vex-overlay.json \ # --out-dir advisories/out # # Inputs (tracked in git): advisories/records/*.json + advisories/vex-overlay.json # Outputs (build artifacts): advisories/out/*.{csaf,cdx}.json ADVISORY_RECORDS_DIR = $(srcdir)/advisories/records ADVISORY_OVERLAY = $(srcdir)/advisories/vex-overlay.json ADVISORY_OUT_DIR = $(abs_builddir)/advisories/out advisorydir = $(datadir)/doc/$(PACKAGE)/advisories .PHONY: advisory install-advisory uninstall-advisory # Generate one CSAF + one CycloneDX VEX document per CVE record. Honors # SOURCE_DATE_EPOCH for reproducible output (set from the last git commit when # unset and a git tree is available), exactly like `make sbom`. advisory: @if test -z "$(PYTHON3)"; then \ echo ""; \ echo "ERROR: 'python3' not found in PATH. Cannot generate advisories."; \ echo ""; \ exit 1; \ fi @set -e; \ if test -z "$${SOURCE_DATE_EPOCH:-}" && test -n "$(GIT)" && \ $(GIT) -C "$(srcdir)" rev-parse --git-dir >/dev/null 2>&1; then \ sde=`$(GIT) -C "$(srcdir)" log -1 --format=%ct 2>/dev/null`; \ if test -n "$$sde"; then \ SOURCE_DATE_EPOCH="$$sde"; \ export SOURCE_DATE_EPOCH; \ fi; \ fi; \ $(PYTHON3) $(srcdir)/scripts/gen-advisory \ --records-dir $(ADVISORY_RECORDS_DIR) \ --vex-overlay $(ADVISORY_OVERLAY) \ --out-dir $(ADVISORY_OUT_DIR) install-advisory: advisory $(MKDIR_P) $(DESTDIR)$(advisorydir) @for f in $(ADVISORY_OUT_DIR)/*.json; do \ test -f "$$f" || continue; \ echo " $(INSTALL_DATA) $$f $(DESTDIR)$(advisorydir)/"; \ $(INSTALL_DATA) "$$f" $(DESTDIR)$(advisorydir)/; \ done uninstall-advisory: -rm -f $(DESTDIR)$(advisorydir)/*.csaf.json -rm -f $(DESTDIR)$(advisorydir)/*.cdx.json CLEANFILES += advisories/out/*.csaf.json advisories/out/*.cdx.json # Ship the advisory generator inputs in the dist tarball so a downstream # consumer can `./configure && make advisory` from a release. The per-CVE # records are copied via dist-hook (glob) rather than listed in EXTRA_DIST so # a newly-added record ships automatically: a hardcoded list silently drops # new records from `make dist`, and the omission only surfaces as a failing # downstream `make advisory`. EXTRA_DIST += advisories/vex-overlay.json dist-hook: $(MKDIR_P) $(distdir)/advisories/records @for f in $(srcdir)/advisories/records/*.json; do \ test -f "$$f" || continue; \ cp -p "$$f" $(distdir)/advisories/records/; \ done # Bomsh (OmniBOR build artifact tracing + SBOM enrichment) BOMSH_RAWLOG_BASE = $(abs_builddir)/bomsh_raw_logfile BOMSH_RAWLOG = $(BOMSH_RAWLOG_BASE).sha1 BOMSH_CONF = $(abs_builddir)/_bomsh.conf BOMSH_OMNIBORDIR = $(abs_builddir)/omnibor BOMSH_SPDX_OUT = omnibor.wolfssl-$(PACKAGE_VERSION).spdx.json bomshdir = $(datadir)/doc/$(PACKAGE) .PHONY: bomsh install-bomsh uninstall-bomsh # Self-contained: the traced rebuild also regenerates the SBOM, so users # can run `make bomsh` directly without first running `make sbom`. This is # also what makes the combined workflow correct: `make sbom` writes the SPDX, # but `make bomsh` issues `make clean` (which removes it via CLEANFILES), so # the only reliable way to enrich is to regenerate after the traced build. # # After the traced rebuild we discover the bomsh-traced library in # $(abs_builddir)/src/.libs/ and pass it to the nested `make sbom` call as # SBOM_LIB_OVERRIDE. Without the override `make sbom` would `make install # DESTDIR=...` into a private tree, which triggers a libtool relink and # produces a binary whose SHA-256 differs from the one bomtrace3 traced. # That left the gitoid in `externalRefs` (which IS for the traced binary) # and the SHA-256 in `checksums[]` (which was NOT) describing two different # files in the same SPDX document. With the override they describe the # same artefact, which is the invariant any auditor reading the document # expects. bomsh: @if test -z "$(BOMTRACE3)"; then \ echo ""; \ echo "ERROR: 'bomtrace3' not found in PATH. Cannot generate OmniBOR data."; \ echo " Build bomtrace3 from: https://github.com/omnibor/bomsh"; \ echo ""; \ exit 1; \ fi @if test -z "$(BOMSH_CREATE_BOM)"; then \ echo ""; \ echo "ERROR: 'bomsh_create_bom.py' not found in PATH. Cannot process OmniBOR data."; \ echo " Install from: https://github.com/omnibor/bomsh"; \ echo ""; \ exit 1; \ fi @if test -z "$(PYTHON3)"; then \ echo ""; \ echo "ERROR: 'python3' not found in PATH. Cannot generate SBOM."; \ echo " (make bomsh re-runs make sbom after the traced build.)"; \ echo ""; \ exit 1; \ fi @if test -z "$(PYSPDXTOOLS)"; then \ echo ""; \ echo "ERROR: 'pyspdxtools' not found in PATH. Cannot validate SBOM."; \ echo " Install: pip install spdx-tools"; \ echo " (make bomsh re-runs make sbom after the traced build.)"; \ echo ""; \ exit 1; \ fi $(MAKE) clean @printf 'raw_logfile=%s\n' '$(BOMSH_RAWLOG_BASE)' > '$(BOMSH_CONF)' $(BOMTRACE3) -c '$(BOMSH_CONF)' $(MAKE) $(BOMSH_CREATE_BOM) -r '$(BOMSH_RAWLOG)' -b '$(BOMSH_OMNIBORDIR)' @set -e; \ bomsh_artifact=""; \ for lib in \ $(addprefix "$(abs_builddir)/src/.libs"/,$(WOLFSSL_LIB_DSO_BASENAMES)) \ "$(abs_builddir)/src/.libs/libwolfssl.a" \ "$(abs_builddir)/src/libwolfssl.a"; do \ if test -f "$$lib"; then bomsh_artifact="$$lib"; break; fi; \ done; \ if test -z "$$bomsh_artifact"; then \ echo "NOTE: no built libwolfssl artifact found in $(abs_builddir)/src/.libs/"; \ echo " OmniBOR graph produced; SBOM regeneration + SPDX"; \ echo " enrichment skipped."; \ exit 0; \ fi; \ echo "bomsh: traced binary -> $$bomsh_artifact"; \ $(MAKE) sbom SBOM_LIB_OVERRIDE="$$bomsh_artifact"; \ if test -z "$(BOMSH_SBOM)"; then \ echo "NOTE: bomsh_sbom.py not in PATH; skipping SPDX enrichment."; \ echo " The OmniBOR graph in $(BOMSH_OMNIBORDIR) is still produced."; \ echo " The base SBOM in $(SBOM_SPDX) already hashes the bomsh-traced binary."; \ exit 0; \ fi; \ echo "Enriching SPDX with OmniBOR ExternalRefs (artifact: $$bomsh_artifact)..."; \ $(BOMSH_SBOM) \ -b '$(BOMSH_OMNIBORDIR)' \ -i '$(abs_builddir)/$(SBOM_SPDX)' \ -f "$$bomsh_artifact" \ -s spdx-json \ -O '$(abs_builddir)' install-bomsh: bomsh $(MKDIR_P) '$(DESTDIR)$(bomshdir)/omnibor' @if test -d '$(BOMSH_OMNIBORDIR)'; then \ cp -R '$(BOMSH_OMNIBORDIR)/.' '$(DESTDIR)$(bomshdir)/omnibor/'; \ fi @if test -f '$(abs_builddir)/$(BOMSH_SPDX_OUT)'; then \ $(INSTALL_DATA) '$(abs_builddir)/$(BOMSH_SPDX_OUT)' '$(DESTDIR)$(bomshdir)/'; \ fi uninstall-bomsh: -rm -rf '$(DESTDIR)$(bomshdir)/omnibor' -rm -f '$(DESTDIR)$(bomshdir)/$(BOMSH_SPDX_OUT)' CLEANFILES += $(BOMSH_RAWLOG) $(BOMSH_RAWLOG_BASE).sha256 $(BOMSH_CONF) $(BOMSH_SPDX_OUT) # Hook SBOM/Bomsh cleanup into `make uninstall` so packagers don't leave # stale artefacts behind after install-sbom/install-bomsh. uninstall-sbom # and uninstall-bomsh use `rm -f` / `rm -rf` so they are idempotent and # safe whether or not those targets were ever run. Depending on them # rather than duplicating their bodies keeps the cleanup paths in lock # step with install-sbom/install-bomsh. uninstall-hook: uninstall-sbom uninstall-bomsh uninstall-advisory