sbom: add --dep-openssl for OpenSSL-compat products

Add an openssl entry to DEP_META (Apache-2.0, OpenSSL 3.x git-tag purl)
and a --dep-openssl flag so OpenSSL-compat products (wolfProvider,
wolfEngine) can record OpenSSL as a dependency component alongside
wolfSSL. Update tests.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

Author: sameehj

scripts/gen-sbom

@@ -145,6 +145,21 @@ DEP_META = {
         # vendor:product mapping a pkg:generic PURL would force.
         'purl': lambda v: f'pkg:github/madler/zlib@{v}',
     },
+    # openssl, declared as a dependency by the OpenSSL-compat products
+    # (wolfProvider, wolfEngine) that link libcrypto/libssl alongside wolfSSL.
+    # Only emitted when the caller passes --dep-openssl yes.  These products
+    # target the OpenSSL 3.x provider/engine ABI, which is Apache-2.0 (older
+    # 1.1.x was the SPDX "OpenSSL" licence); Apache-2.0 is therefore the correct
+    # id for the supported surface.  The purl uses OpenSSL 3.x's "openssl-X.Y.Z"
+    # git tag form so it resolves in OSV / GHSA.
+    'openssl': {
+        'name': 'openssl',
+        'supplier': 'OpenSSL Software Foundation',
+        'license': 'Apache-2.0',
+        'download': 'https://github.com/openssl/openssl',
+        'pkgconfig': 'openssl',
+        'purl': lambda v: f'pkg:github/openssl/openssl@openssl-{v}',
+    },
 }
 
 
@@ -1162,6 +1177,12 @@ def main():
                              'wolfSSL\'s own SBOM leaves this off. Combine '
                              'with --dep-version wolfssl=X.Y.Z on hosts '
                              'without wolfssl.pc.')
+    parser.add_argument('--dep-openssl', default='no',
+                        help='yes to record openssl as a dependency component '
+                             '(for OpenSSL-compat products such as wolfProvider '
+                             '/ wolfEngine that link libcrypto/libssl). Combine '
+                             'with --dep-version openssl=X.Y.Z on hosts without '
+                             'openssl.pc.')
     parser.add_argument('--dep-libz', default='no',
                         help='yes if built with --with-libz')
     parser.add_argument('--dep-liboqs', default='no',
@@ -1234,6 +1255,7 @@ def main():
     enabled_deps = [
         key for key, flag in [
             ('wolfssl', args.dep_wolfssl),
+            ('openssl', args.dep_openssl),
             ('libz',    args.dep_libz),
             ('liboqs',  args.dep_liboqs),
         ]

scripts/test_gen_sbom.py

@@ -828,10 +828,11 @@ class TestDepMetaShape(unittest.TestCase):
 
     def test_only_expected_deps_are_tracked(self):
         # wolfssl is tracked so downstream wolfSSL-stack products (wolfSSH,
-        # wolfMQTT, ...) can declare it via --dep-wolfssl; libz/liboqs are
-        # wolfSSL's own optional linked deps.
+        # wolfMQTT, ...) can declare it via --dep-wolfssl; openssl so the
+        # OpenSSL-compat products (wolfProvider, wolfEngine) can declare it via
+        # --dep-openssl; libz/liboqs are wolfSSL's own optional linked deps.
         self.assertEqual(set(gs.DEP_META.keys()),
-                         {'wolfssl', 'libz', 'liboqs'})
+                         {'wolfssl', 'openssl', 'libz', 'liboqs'})
 
     def test_wolfssl_dep_entry_describes_the_linked_artefact(self):
         wolfssl = gs.DEP_META['wolfssl']
@@ -847,6 +848,19 @@ def test_wolfssl_dep_entry_describes_the_linked_artefact(self):
             wolfssl['purl']('5.7.4'),
             'pkg:github/wolfSSL/wolfssl@v5.7.4')
 
+    def test_openssl_dep_entry_describes_the_linked_artefact(self):
+        openssl = gs.DEP_META['openssl']
+        self.assertEqual(openssl['name'], 'openssl')
+        self.assertEqual(openssl['supplier'], 'OpenSSL Software Foundation')
+        self.assertEqual(openssl['pkgconfig'], 'openssl')
+        # wolfProvider / wolfEngine target the OpenSSL 3.x provider/engine ABI,
+        # which is Apache-2.0.  The purl uses OpenSSL 3.x's "openssl-X.Y.Z" git
+        # tag form so it resolves in OSV / GHSA.
+        self.assertEqual(openssl['license'], 'Apache-2.0')
+        self.assertEqual(
+            openssl['purl']('3.5.0'),
+            'pkg:github/openssl/openssl@openssl-3.5.0')
+
     def test_liboqs_entry_describes_the_linked_artefact(self):
         liboqs = gs.DEP_META['liboqs']
         self.assertEqual(liboqs['name'], 'liboqs')
@@ -887,6 +901,7 @@ def test_dep_liboqs_is_accepted(self):
         self.assertIn('--dep-liboqs', result.stdout)
         self.assertIn('--dep-libz', result.stdout)
         self.assertIn('--dep-wolfssl', result.stdout)
+        self.assertIn('--dep-openssl', result.stdout)
 
     def test_removed_flags_are_rejected(self):
         # Each of these was either renamed (--dep-falcon -> --dep-liboqs)