feat(sbom): validation, reproducibility, install targets

- Validate SPDX with pyspdxtools and emit tag-value wolfhsm-<ver>.spdx;
  SBOM_VALIDATE=no skips both
- Honor SOURCE_DATE_EPOCH, defaulting to last git commit time, so
  repeated runs are byte-identical
- Add opt-in install-sbom / uninstall-sbom under
  $(PREFIX)/share/doc/wolfhsm
- List wolfssl as a dependency component with version read from
  WOLFSSL_DIR; SBOM_DEP_WOLFSSL=no for WOLFHSM_CFG_NO_CRYPTO builds

Author: MarkAtwood

Makefile

@@ -61,12 +61,17 @@ clean:
 CC            ?= cc
 WOLFSSL_DIR   ?= ../wolfssl
 WOLFHSM_CFG_DIR ?= test/config
+PREFIX        ?= /usr/local
+SBOM_INSTALL_DIR ?= $(PREFIX)/share/doc/wolfhsm
+SBOM_VALIDATE ?= yes
+SBOM_DEP_WOLFSSL ?= yes
 VERSION        = $(shell sed -n 's/^. wolfHSM Release v//p' ChangeLog.md | head -1 | cut -d' ' -f1)
 SRCS          := $(sort $(wildcard src/*.c))
 SBOM_CDX       = wolfhsm-$(VERSION).cdx.json
 SBOM_SPDX      = wolfhsm-$(VERSION).spdx.json
+SBOM_SPDX_TV   = wolfhsm-$(VERSION).spdx
 
-.PHONY: sbom
+.PHONY: sbom install-sbom uninstall-sbom
 
 sbom:
 	@if [ -z "$(VERSION)" ]; then \
@@ -91,6 +96,13 @@ sbom:
 	    echo "       wolfhsm_cfg.h (and user_settings.h) your build uses." >&2; \
 	    exit 1; \
 	fi
+	@if [ "$(SBOM_VALIDATE)" != "no" ] && \
+	    ! command -v pyspdxtools >/dev/null 2>&1; then \
+	    echo "ERROR: 'pyspdxtools' not found (pip install spdx-tools)." >&2; \
+	    echo "       It validates the SPDX output and converts it to" >&2; \
+	    echo "       tag-value. Set SBOM_VALIDATE=no to skip both." >&2; \
+	    exit 1; \
+	fi
 	@echo "wolfHSM version: $(VERSION)"
 	@echo "Sources:         $(words $(SRCS)) .c files in src/"
 	@echo "Config:          $(WOLFHSM_CFG_DIR)/wolfhsm_cfg.h"
@@ -124,13 +136,59 @@ sbom:
 	if ! command -v python3 >/dev/null 2>&1; then \
 	    echo "ERROR: python3 not found." >&2; exit 1; \
 	fi && \
+	if [ -z "$${SOURCE_DATE_EPOCH:-}" ] && \
+	    command -v git >/dev/null 2>&1 && \
+	    git rev-parse --git-dir >/dev/null 2>&1; then \
+	    sde=$$(git log -1 --format=%ct 2>/dev/null); \
+	    if [ -n "$$sde" ]; then \
+	        SOURCE_DATE_EPOCH="$$sde"; export SOURCE_DATE_EPOCH; \
+	    fi; \
+	fi && \
+	dep_args=""; \
+	if [ "$(SBOM_DEP_WOLFSSL)" != "no" ]; then \
+	    if python3 $(WOLFSSL_DIR)/scripts/gen-sbom --help 2>/dev/null \
+	        | grep -q -- '--dep-wolfssl'; then \
+	        dep_args="--dep-wolfssl yes"; \
+	        wv=$$(sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
+	            "$(WOLFSSL_DIR)/wolfssl/version.h" 2>/dev/null); \
+	        if [ -n "$$wv" ]; then \
+	            dep_args="$$dep_args --dep-version wolfssl=$$wv"; \
+	        fi; \
+	    else \
+	        echo "NOTE: this gen-sbom lacks --dep-wolfssl; wolfssl will not"; \
+	        echo "      be listed as a dependency component in the SBOM."; \
+	    fi; \
+	fi && \
 	python3 $(WOLFSSL_DIR)/scripts/gen-sbom \
 	    --name wolfhsm \
 	    --version $(VERSION) \
 	    --supplier "wolfSSL Inc." \
 	    --license-file LICENSING \
 	    --options-h "$$_defines" \
 	    --srcs $(SRCS) \
+	    $$dep_args \
 	    --cdx-out $(SBOM_CDX) \
-	    --spdx-out $(SBOM_SPDX)
-	@echo "Done: $(SBOM_CDX)  $(SBOM_SPDX)"
+	    --spdx-out $(SBOM_SPDX) && \
+	if [ "$(SBOM_VALIDATE)" != "no" ]; then \
+	    pyspdxtools --infile $(SBOM_SPDX) --outfile $(SBOM_SPDX_TV) && \
+	    echo "Done: $(SBOM_CDX)  $(SBOM_SPDX)  $(SBOM_SPDX_TV)"; \
+	else \
+	    echo "Done: $(SBOM_CDX)  $(SBOM_SPDX)"; \
+	fi
+
+# SBOM install is opt-in (`make install-sbom`), matching the family
+# convention in wolfssl's scripts/sbom.am: plain `make` never installs
+# SBOM files.  wolfHSM's root Makefile has no install/uninstall targets
+# to hook, so uninstall-sbom is standalone rather than chained.
+install-sbom: sbom
+	@mkdir -p $(DESTDIR)$(SBOM_INSTALL_DIR)
+	install -m 0644 $(SBOM_CDX) $(DESTDIR)$(SBOM_INSTALL_DIR)/
+	install -m 0644 $(SBOM_SPDX) $(DESTDIR)$(SBOM_INSTALL_DIR)/
+	@if [ -f "$(SBOM_SPDX_TV)" ]; then \
+	    install -m 0644 $(SBOM_SPDX_TV) $(DESTDIR)$(SBOM_INSTALL_DIR)/; \
+	fi
+
+uninstall-sbom:
+	-rm -f $(DESTDIR)$(SBOM_INSTALL_DIR)/$(SBOM_CDX) \
+	    $(DESTDIR)$(SBOM_INSTALL_DIR)/$(SBOM_SPDX) \
+	    $(DESTDIR)$(SBOM_INSTALL_DIR)/$(SBOM_SPDX_TV)

README.md

@@ -38,7 +38,17 @@ make sbom WOLFSSL_DIR=../wolfssl
 ```
 
 This parses the version from `ChangeLog.md`, collects `src/*.c`, and writes
-`wolfhsm-<version>.cdx.json` and `wolfhsm-<version>.spdx.json`.
+`wolfhsm-<version>.cdx.json` and `wolfhsm-<version>.spdx.json`, then
+validates the SPDX output with `pyspdxtools` and converts it to tag-value
+`wolfhsm-<version>.spdx` (skip both with `SBOM_VALIDATE=no`). The SBOM
+lists wolfSSL as a dependency component with its version read from
+`WOLFSSL_DIR` (disable with `SBOM_DEP_WOLFSSL=no` for a
+`WOLFHSM_CFG_NO_CRYPTO` build). Output is reproducible: `SOURCE_DATE_EPOCH`
+is honoured and defaults to the last git commit time.
+
+Install the generated files under `$(PREFIX)/share/doc/wolfhsm` (default
+`PREFIX=/usr/local`) with `make install-sbom`; remove them with
+`make uninstall-sbom`. Plain `make` never generates or installs SBOM files.
 
 The SBOM records the build configuration by preprocessing
 `wolfhsm/wh_settings.h` against a config directory. `WOLFHSM_CFG_DIR`
@@ -59,7 +69,8 @@ the planned gen-sbom fix is.
 which ships in wolfSSL PR #10343 (pending a future wolfSSL release). If the
 script is absent the target fails with a message telling you what is missing.
 
-Requires `python3` and `pyspdxtools` (`pip install spdx-tools`).
+Requires `python3`, plus `pyspdxtools` (`pip install spdx-tools`) unless
+`SBOM_VALIDATE=no`.
 
 To invoke `gen-sbom` directly instead of through the target, run the same
 command it runs: