fix(sbom.am): capture build macros with host cc, not cross $(CC) - #18
Open
MarkAtwood wants to merge 1 commit into
Open
fix(sbom.am): capture build macros with host cc, not cross $(CC)#18MarkAtwood wants to merge 1 commit into
MarkAtwood wants to merge 1 commit into
Conversation
The autotools path expanded the build macros with the configured $(CC) and the full AM_CFLAGS/CFLAGS, so a cross-compiled build baked the cross compiler's target-specific predefined macros into the SBOM -- the same product built through a different toolchain produced a different document, breaking the byte-reproducibility contract the Make and CMake paths honour via their HOSTCC. Add SBOM_HOSTCC (default cc) and expand only the -D/-U/-I tokens of the flag set through it, so target arch flags it cannot parse are dropped and the capture is toolchain-independent. SBOM_OPTIONS_H (pre-expanded) and config.h handling are unchanged.
There was a problem hiding this comment.
Pull request overview
This PR updates the autotools SBOM generation fragment (share/sbom.am) to make macro-capture reproducible across cross toolchains by switching macro expansion to a host compiler and limiting which flags are fed into that expansion.
Changes:
- Adds
SBOM_HOSTCCand uses it (instead of$(CC)) for preprocessor macro capture. - Filters macro-capture inputs to only
-D/-U/-Itokens fromAM_CPPFLAGS/CPPFLAGS/AM_CFLAGS/CFLAGSbefore invoking the preprocessor.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+78
to
+82
| # the cross compiler's target-specific predefined macros into the SBOM, so the | ||
| # same product built through a different toolchain would produce a different | ||
| # document. Only the -D/-U/-I tokens are fed to it (see the capture below), so | ||
| # it never sees target arch flags it cannot parse. | ||
| SBOM_HOSTCC ?= cc |
Comment on lines
+173
to
+176
| sbom_cpp=""; \ | ||
| for f in $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS); do \ | ||
| case "$$f" in -D*|-U*|-I*) sbom_cpp="$$sbom_cpp $$f";; esac; \ | ||
| done; \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The autotools path expanded the build macros with the configured
$(CC)and the fullAM_CFLAGS/CFLAGS, so a cross-compiled build baked the cross compiler's target-specific predefined macros into the SBOM — the same product built through a different toolchain produced a different document, breaking the byte-reproducibility the Make/CMake paths honour via theirHOSTCC.Adds
SBOM_HOSTCC(defaultcc) and expands only the-D/-U/-Itokens of the flag set through it, so target arch flags a host cc can't parse are dropped and the capture is toolchain-independent.SBOM_OPTIONS_H(pre-expanded) and config.h handling are unchanged.Verified the shell filter standalone: representative cross flags (
-DWOLFSSL_*,-mcpu=cortex-m4,-mthumb,-Os) → hostcccaptures every feature macro, drops the arch flags, and leaks no__ARM_ARCH/target builtins; the unfiltered form rejects oncc. (The recipe isn't unit-testable in-repo without a full autotools product; productmake sbomCI exercises it.)fix/autotools-gen-sbom-discovery) — both touchsbom.am. Merge #6 first. Addresses SBOM-gpex.10.