feat: add make sbom target

[MarkAtwood]

Summary

Adds make sbom, make install-sbom, and make uninstall-sbom targets to the autotools build.

• Stages a temporary install to extract the built .so for hashing
• Dumps preprocessor defines via cc -dM -E for the options snapshot
• Calls gen-sbom (from wolfssl scripts/gen-sbom) to produce CycloneDX and SPDX outputs
• Validates SPDX with pyspdxtools

Usage

```sh
./configure --with-wolfssl=/path/to/wolfssl/install
make
make sbom WOLFSSL_DIR=/path/to/wolfssl/source
```

Outputs: wolfmqtt-<version>.cdx.json, wolfmqtt-<version>.spdx.json, wolfmqtt-<version>.spdx

Requirements

• WOLFSSL_DIR must point to a wolfssl source tree containing scripts/gen-sbom (available on the feat/sbom-embedded branch of wolfssl)
• python3 and pip install spdx-tools on the build host

Test plan

• ./configure --with-wolfssl=... && make && make sbom WOLFSSL_DIR=...
• Verify three output files are produced
• pyspdxtools --infile wolfmqtt-*.spdx.json passes validation

CMake support

The same SBOM workflow is available for cmake builds via a sbom custom target.

cmake -B build -DWOLFSSL_DIR=/path/to/wolfssl/source .
cmake --build build
cmake --build build --target sbom

The cmake target mirrors the autotools one:

• Version is read from wolfmqtt/version.h (not project(VERSION)) so both build systems emit the same version.
• Stages a cmake --install to hash the installed libwolfmqtt.so.
• Dumps preprocessor defines via cc -dM -E on the generated options.h.
• Validates SPDX with pyspdxtools.
• WOLFSSL_DIR, python3, and pyspdxtools are checked at configure time (fatal error if missing) so problems surface before building.

Outputs (in the build directory): wolfmqtt-<version>.cdx.json, wolfmqtt-<version>.spdx.json, wolfmqtt-<version>.spdx

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds new autotools make sbom workflow to generate and install SBOM artifacts (CycloneDX + SPDX) for CRA compliance, plus updates repo guidance/docs.

Changes:

• Add SBOM-related make sbom, make install-sbom, make uninstall-sbom targets (staging install, calling gen-sbom, validating SPDX).
• Extend configure.ac to expose libtool version components and discover SBOM tooling (python3, pyspdxtools, git).
• Add/update contributor and build documentation under AI/, plus refresh AGENTS.md and ignore common AI tool local files.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
configure.ac	Exposes version components + finds SBOM tool executables for substitution into make rules
Makefile.am	Implements SBOM generation/validation and install/uninstall targets
AI/contributing.md	New contribution guidelines (workflow, CI rules, testing)
AI/build-windows.md	New Windows build guide
AI/build-linux.md	New Linux/macOS build guide
AI/build-embedded.md	New embedded/RTOS build guide
AGENTS.md	Replaces prior agent guidance with repo overview + links to new docs
.gitignore	Ignores common AI-tool local configuration directories/files

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.