[Frauschi]

What

Follow-up to #36 for the CMake helper's directory scope, plus a refinement of the SOURCE_DATE_EPOCH lookup.

• Sibling-directory calls: sbom.cmake kept its own directory and the python3 it found in directory-scoped variables. Including it in one subdirectory and calling wolfssl_compliance_tooling_add_sbom() from another failed at configure time with "python3 was not found", with empty driver and script paths behind it. The fragment now also records both in global properties, used only when the calling directory has no value of its own. A call from a directory that included a copy, or from its children, uses that copy, so a subproject vendoring a different pin no longer redirects the top project's SBOM. A call from an unrelated sibling uses the copy included last, as the function definition does.
• Commit time for a subdirectory ROOT: sbom-with-sde.cmake used the commit time only when SBOM_ROOT was the git toplevel, so a ROOT below its own repo's top got gen-sbom's default timestamp. It now uses the commit time when SBOM_ROOT holds tracked files (git ls-files --error-unmatch -- .). A tarball unpacked into an untracked directory of another checkout holds none, so it still does not inherit the outer commit time. A ROOT holding any file tracked by another repository (a committed copy, or a wrapper CMakeLists.txt next to an unpacked tarball) takes that repository's commit time.
• sbom.am used any enclosing repository's commit time; it now applies the same tracked-files check to srcdir.

Tests

• test_call_from_a_sibling_directory_builds (configure, sbom, install-sbom), test_call_uses_its_own_directory_copy and test_tracked_subdirectory_uses_the_commit_time in test_sbom_cmake_install.py. The first and last fail on master; the middle one guards against a regression a global-only lookup would cause. A superbuild mixing this copy with a pre-fix one also builds for calls from directories that included a copy (checked by hand).
• The existing nested-tarball test still passes.
• Independent of the other two open follow-ups; all three merge cleanly in any order and pass together.

[Copilot]

🟢 Approval recommended

The scoped fallbacks and tracked-file timestamp checks are consistent with the intended behavior, with regression coverage and no identified blocking issues.

No open issues 🎉

What changed in this PR

This follow-up to #36 makes the CMake SBOM helpers usable across sibling directories while preserving each caller’s local tooling copy. It also aligns timestamp selection between CMake and Automake.

Changes:

• Add global fallbacks for helper paths and Python without overriding directory-local values.
• Use the enclosing repository’s commit time for roots containing tracked files, excluding untracked nested tarballs.
• Add regression tests for sibling-directory calls, vendored-copy isolation, and tracked-subdirectory timestamps.

File	Description
tests/​test_sbom_cmake_install.py	Adds directory-scope and timestamp regression tests.
share/​sbom.am	Requires tracked files before using Git’s commit time.
share/​build/​sbom.cmake	Adds directory-aware fallbacks for generation and installation helpers.
share/​build/​sbom-with-sde.cmake	Extends commit-time selection to tracked subdirectories.

_{Review effort: Balanced}