SBOM dep cpe purl

.github/workflows/sbom.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches: [ 'master', 'main', 'release/**' ]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '**' ]
 
 # Defence-in-depth: the workflow does no API writes (no `gh pr`, no
@@ -28,7 +29,7 @@ jobs:
   # cheapest gate for licence/UUID/timestamp logic regressions.
   unit:
     name: gen-sbom unit tests
-    if: github.repository_owner == 'wolfssl'
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -64,7 +65,7 @@ jobs:
   # --srcs, or --dep-version handling would silently land.
   standalone:
     name: SBOM standalone (no autotools)
-    if: github.repository_owner == 'wolfssl'
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04
     needs: unit
     timeout-minutes: 10
@@ -423,7 +424,7 @@ jobs:
   # everything an external auditor or vulnerability scanner relies on.
   integration:
     name: SBOM integration (linux)
-    if: github.repository_owner == 'wolfssl'
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04
     needs: unit
     timeout-minutes: 20
@@ -516,15 +517,20 @@ jobs:
         # GitHub Security Advisories index is also pinned so an auditor
         # reading the SBOM has a single in-document link to the project's
         # disclosures.
+        # purl-spec lowercases the github namespace/name; wolfSSL tags are
+        # `vX.Y.Z-stable`, so the version is not digits-and-dots alone.
         run: |
           python3 - <<'PY'
           import glob, json, re
           with open(glob.glob('wolfssl-*.spdx.json')[0]) as f:
               d = json.load(f)
+          pkg = next(p for p in d['packages'] if p['name'] == 'wolfssl')
           refs = {r['referenceType']: r['referenceLocator']
-                  for r in d['packages'][0]['externalRefs']}
+                  for r in pkg['externalRefs']}
           assert re.match(r'cpe:2\.3:a:wolfssl:wolfssl:[\d.]+:', refs['cpe23Type']), refs
-          assert re.match(r'pkg:github/wolfSSL/wolfssl@v[\d.]+', refs['purl']), refs
+          assert re.match(
+              r'pkg:github/wolfssl/wolfssl@v[\d.]+(-stable)?$',
+              refs['purl']), refs
           assert refs['advisory'] == \
               'https://github.com/wolfSSL/wolfssl/security/advisories', refs
           print('identifiers ok:', refs)
@@ -753,7 +759,7 @@ jobs:
   # macOS runner minutes go to portability coverage, not duplicated checks.
   integration-macos:
     name: SBOM integration (macos)
-    if: github.repository_owner == 'wolfssl'
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: macos-latest
     needs: unit
     timeout-minutes: 20
@@ -813,7 +819,7 @@ jobs:
   # exercised by hand; a regression in either would silently land.
   bomsh:
     name: bomsh integration (linux)
-    if: github.repository_owner == 'wolfssl'
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04
     needs: unit
     timeout-minutes: 30

Makefile.am

@@ -583,6 +583,8 @@ sbom:
 	    --options-h $(abs_builddir)/wolfssl/options.h \
 	    --lib "$$sbom_lib" \
 	    --dep-libz "$(ENABLED_LIBZ)" \
+	    --dep-wolfcrypt yes \
+	    --dep-version wolfcrypt=$(PACKAGE_VERSION) \
 	    $(foreach dv,$(SBOM_DEP_VERSIONS),--dep-version '$(dv)') \
 	    --cdx-out $(abs_builddir)/$(SBOM_CDX) \
 	    --spdx-out $(abs_builddir)/$(SBOM_SPDX); \