Summary
The autotools SBOM fragment's gen-sbom auto-discovery is broken, and the WOLFSSL_DIR fallback for locating gen-sbom was dropped.
Location
share/sbom.am:67,77
Details
SBOM_GEN ?= $(abspath $(dir $(lastword $(MAKEFILE_LIST)))/gen-sbom) assumes $(MAKEFILE_LIST) contains sbom.am. It never does: Automake's include directive textually inlines the fragment into the generated Makefile at automake time, so at runtime $(lastword $(MAKEFILE_LIST)) is the top-level Makefile in the build tree. SBOM_GEN therefore resolves to <builddir>/gen-sbom, the test -f "$(SBOM_GEN)" check fails, and make sbom breaks unless every product manually overrides SBOM_GEN — despite the header comment promising automatic discovery.
The .mk (GNU-make runtime include, so MAKEFILE_LIST really does contain sbom.mk) and .cmake (CMAKE_CURRENT_LIST_DIR) paths are correct — only the autotools path is wrong.
Separately, this copy dropped the WOLFSSL_DIR fallback for locating gen-sbom, which will break wolfSSH-style consumers that run make sbom WOLFSSL_DIR=/path/to/wolfssl.
Fix
Default SBOM_GEN to a srcdir-relative vendored path (e.g. $(srcdir)/tools/sbom/gen-sbom), or make the product override mandatory and drop the MAKEFILE_LIST heuristic. Decide and document the gen-sbom lookup contract (vendored sibling vs WOLFSSL_DIR).
Severity
High — make sbom fails on the autotools path without a manual override.
Found in an internal review (2026-07-23). Tracked internally as SBOM-gpex.3.
Summary
The autotools SBOM fragment's gen-sbom auto-discovery is broken, and the
WOLFSSL_DIRfallback for locating gen-sbom was dropped.Location
share/sbom.am:67,77Details
SBOM_GEN ?= $(abspath $(dir $(lastword $(MAKEFILE_LIST)))/gen-sbom)assumes$(MAKEFILE_LIST)containssbom.am. It never does: Automake'sincludedirective textually inlines the fragment into the generatedMakefileat automake time, so at runtime$(lastword $(MAKEFILE_LIST))is the top-levelMakefilein the build tree.SBOM_GENtherefore resolves to<builddir>/gen-sbom, thetest -f "$(SBOM_GEN)"check fails, andmake sbombreaks unless every product manually overridesSBOM_GEN— despite the header comment promising automatic discovery.The
.mk(GNU-make runtimeinclude, soMAKEFILE_LISTreally does containsbom.mk) and.cmake(CMAKE_CURRENT_LIST_DIR) paths are correct — only the autotools path is wrong.Separately, this copy dropped the
WOLFSSL_DIRfallback for locating gen-sbom, which will break wolfSSH-style consumers that runmake sbom WOLFSSL_DIR=/path/to/wolfssl.Fix
Default
SBOM_GENto a srcdir-relative vendored path (e.g.$(srcdir)/tools/sbom/gen-sbom), or make the product override mandatory and drop theMAKEFILE_LISTheuristic. Decide and document the gen-sbom lookup contract (vendored sibling vsWOLFSSL_DIR).Severity
High —
make sbomfails on the autotools path without a manual override.Found in an internal review (2026-07-23). Tracked internally as SBOM-gpex.3.