[Frauschi]

What

gen-sbom --macro-prefix PREFIX (repeatable) records only the captured build macros whose name starts with one of the prefixes. It is meant for a product that shares one user_settings.h with wolfSSL, such as wolfCert, whose SBOM today records every wolfSSL macro as the product's own configuration.

• Applies to --options-h and --user-settings alike. --crypto-only auto still reads the full capture.
• The scope is recorded in the document (wolfssl:sbom:macro-prefix property in CycloneDX, annotation in SPDX) and folded into the config identity only when set, so existing SBOMs keep their serialNumber.
• Each prefix that matches nothing warns, and so does a prefix given when nothing was captured. An empty prefix, one with surrounding whitespace, or one containing a comma is an error.
• With --crypto-only auto, wolfssl-subset-basis=captured can rest on a macro the prefix filtered out of the document (for example WOLFCRYPT_ONLY); that is intended, and the docstring says so.
• Wired through the build fragments: driver (forwarded only when gen-sbom advertises it, with a note when dropped), CMake MACRO_PREFIX, sbom.mk and sbom.am SBOM_MACRO_PREFIX.
• sbom.am also gains SBOM_USER_SETTINGS / SBOM_USER_SETTINGS_INCLUDES / SBOM_USER_SETTINGS_DEFINES, matching the CMake and Make paths.
• Not covered yet: the compdb and IAR frontends have no --macro-prefix option.

Tests

• TestMacroPrefix in test_gen_sbom.py (12 tests), identity coverage in test_sbom_identity.py, end-to-end generate plus driver forwarding in test_sbom.py.
• Fragment wiring: CMake MACRO_PREFIX in test_sbom_cmake_install.py, sbom.mk in test_sbom.py, and sbom.am (SBOM_MACRO_PREFIX plus the three SBOM_USER_SETTINGS errors) in test_sbom_autotools.py. The SBOM_USER_SETTINGS capture itself needs pcpp and runs in CI.
• Independent of the other two open follow-ups (driver input checks, CMake helper scope); all three merge cleanly in any order and pass together.

[Copilot]

🟢 Approval recommended

The scoped filtering, backward-compatible identity handling, and build integrations are consistent with the stated behavior, with no unresolved blocking findings.

No open issues 🎉

What changed in this PR

Adds macro-prefix filtering to the shared SBOM generator so products can record their own configuration macros from a header shared with wolfSSL.

Changes:

• Filters recorded macros while preserving full-capture crypto-only detection and unchanged document identities when no prefix is set.
• Forwards prefixes through the driver, CMake, Make, and Autotools; adds Autotools user-settings inputs.
• Adds tests for filtering, validation, identity, and build integration, plus usage documentation.

File	Description
tests/​test_sbom.py	Tests driver forwarding, fallback notes, and Make integration.
tests/​test_sbom_identity.py	Tests prefix-sensitive identity and default compatibility.
tests/​test_sbom_cmake_install.py	Tests CMake prefix forwarding.
tests/​test_sbom_autotools.py	Tests prefix filtering and user-settings input checks.
tests/​test_gen_sbom.py	Tests filtering, metadata, warnings, and validation.
share/​sbom.am	Adds prefix forwarding and user-settings capture inputs.
share/​sbom-driver.py	Forwards prefixes when supported by the generator.
share/​README.md	Documents filtering and Autotools configuration.
share/​gen-sbom	Implements filtering, scope metadata, and identity handling.
share/​build/​sbom.mk	Forwards SBOM_MACRO_PREFIX to the driver.
share/​build/​sbom.cmake	Adds the MACRO_PREFIX argument.
README.md	Documents the Autotools user-settings option.

_{Review effort: Balanced}