INNER CODE UNIT · Python
capture_macros
wolfSSL/wolfBoot · tools/sbom/sbom-driver.py:139
def capture_macros(hostcc, cflags, settings_h="", include_dirs=()):
"""Expand a build configuration through the host compiler's -dM -E.
The capture must see BOTH inputs that determine the configuration:
* the ``-D`` tokens from CFLAGS, which select features
(``-DWOLFBOOT_SIGN_ECC256``), and
* the settings header those tokens are interpreted by, reached via
``-include``.
Feeding only one of them yields a confident, well-formed, wrong document.
With no ``-include``, the compiler reads an empty translation unit and the
dump is just the ``-D`` list plus compiler built-ins, so every macro the
settings header derives is missing. With no ``-D`` tokens, every ``#if``
in that header is evaluated against an empty configuration and the dump
describes a product nobody built -- wolfBoot's user_settings.h gates
HAVE_ECC on WOLFBOOT_SIGN_ECC256, so a capture missing the latter silently
reports a secure bootloader with no signature algorithm.