sbom: Add support for libssh sbom.yml

.github/workflows/version-check.yml

@@ -0,0 +1,45 @@
+name: version-check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  check_version:
+    name: Check version consistency
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Compare idf_component.yml and libssh_version.h
+        shell: bash
+        run: |
+          set -euo pipefail
+          HDR=libssh/port/libssh/libssh_version.h
+          YML=libssh/idf_component.yml
+
+          major=$(sed -n 's/^#define LIBSSH_VERSION_MAJOR[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR")
+          minor=$(sed -n 's/^#define LIBSSH_VERSION_MINOR[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR")
+          micro=$(sed -n 's/^#define LIBSSH_VERSION_MICRO[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR")
+          hdr_ver="${major}.${minor}.${micro}"
+
+          yml_ver=$(sed -n 's/^version:[[:space:]]*"\([^"]*\)".*/\1/p' "$YML")
+          # Component registry may use "0.12.0~1"; compare the semver before '~'
+          yml_base=${yml_ver%%~*}
+
+          echo "libssh_version.h: ${hdr_ver}"
+          echo "idf_component.yml: ${yml_ver} (base ${yml_base})"
+
+          if [[ -z "$major" || -z "$minor" || -z "$micro" || -z "$yml_base" ]]; then
+            echo "::error::Failed to parse version from $HDR or $YML"
+            exit 1
+          fi
+
+          if [[ "$hdr_ver" != "$yml_base" ]]; then
+            echo "::error::Version mismatch: ${HDR} has ${hdr_ver}, ${YML} has ${yml_ver}"
+            exit 1
+          fi
+
+          echo "Versions match."

README.md

@@ -2,21 +2,11 @@
 
 [![Membrowse](https://membrowse.com/badge.svg)](https://membrowse.com/public/david-cermak/libssh)
 
-A minimal ESP-IDF port of libssh.
-The purpose of this component is to provide a way to run `sshd` on your ESP32 device, so you can "ssh" into your device.
+Embedded ports of [libssh](https://www.libssh.org/) so you can run `sshd` on your device and SSH into it.
 
-## How to use
+Supported platforms:
 
-Add the libssh subdirectory to your component list, either using IDF build system or by means of the component yaml file:
-```
-dependencies:
-  libssh:
-    version: '*'
-    path: /path/to/the_libssh_directory/
-```
-
-## Example
-
-See the simple server example in [server](libssh/examples/server)
+- **[ESP-IDF](libssh/README.md)** — ESP32-class devices
+- **[Zephyr](zephyr/README.md)** — Zephyr RTOS boards
 
 ![Demo](ssh-demo.gif)

libssh/CHANGELOG.md

@@ -0,0 +1,19 @@
+See the upstream [CHANGELOG](libssh-mirror/CHANGELOG)
+
+0.12.0~2
+- See upstream changes 0.12.0
+- ESP-IDF: Add SBOM-yml
+- Port: Fix version header to match component version (0.12.0)
+
+0.12.0~1
+- See upstream changes 0.12.0
+- Port: Using native mbedtls-v4 support (instead of mbedtls-v3-shim component)
+- Port: Switched to submodule upstream (instead of downloading release packages)
+
+0.12.0
+- See upstream changes 0.12.0 (Support PQC KEX, security fixes)
+- Port: Make PQC KEX configurable (Default OFF)
+
+0.11.0
+- See upstream changes 0.11.0
+- ESP-IDF: Simple ESP32 SSH server

libssh/README.md

@@ -13,20 +13,25 @@ Minimal ESP-IDF component wrapping upstream libssh to run an SSH server on ESP32
 - Reference projects live in `examples/`.
 
 ### Requirements
-- ESP-IDF v5.x (tested with recent v5 releases).
+- ESP-IDF v5+ (tested with recent v5 and v6 releases).
 - Enable networking (Wi‑Fi or Ethernet) in your project.
 - Recommended: Ed25519 host keys for best performance and security.
 
-### Add to your project (Component Manager)
-Add this dependency to your app's `idf_component.yml`:
+### How to use
+
+Add the libssh subdirectory to your component list, either using the IDF build system or via the component YAML file:
+
+```bash
+idf.py add-dependency david-cermak/libssh
+```
+
+Or pull it from the Component Registry:
 
 ```yaml
 dependencies:
   david-cermak/libssh: "*"
 ```
 
-Or add as a local component via `path` if you vendor the directory into your project.
-
 ### Quick start (examples)
 Build any of the examples under `examples/` using standard ESP-IDF flow:
 

libssh/idf_component.yml

@@ -1,4 +1,4 @@
-version: "0.12.0~1"
+version: "0.12.0~2"
 url: https://github.com/david-cermak/libssh
 license: LGPL-2.1
 description: The component provides a general purpose SSH connectivity

libssh/port/libssh/libssh_version.h

@@ -28,7 +28,7 @@
 
 /* libssh version */
 #define LIBSSH_VERSION_MAJOR  0
-#define LIBSSH_VERSION_MINOR  11
+#define LIBSSH_VERSION_MINOR  12
 #define LIBSSH_VERSION_MICRO  0
 
 #define LIBSSH_VERSION_INT SSH_VERSION_INT(LIBSSH_VERSION_MAJOR, \

libssh/sbom.yml

@@ -0,0 +1,7 @@
+name: 'libssh'
+supplier: 'David Cermak <https://github.com/david-cermak/libssh>'
+originator: 'David Cermak <https://github.com/david-cermak/libssh>'
+description: ESP-IDF component wrapping upstream libssh with an mbedtls crypto backend. Provides SSH2 client/server connectivity for ESP32-class devices; ESP-IDF compatibility shims live under port/.
+manifests:
+  - path: sbom_libssh.yml
+    dest: libssh-mirror

libssh/sbom_libssh.yml

@@ -0,0 +1,11 @@
+name: libssh
+version: 0.12.0
+cpe: cpe:2.3:a:libssh:libssh:{}:*:*:*:*:*:*:*
+supplier: 'Organization: The libssh Project <https://www.libssh.org/>'
+originator: 'Organization: The libssh Project <https://www.libssh.org/>'
+description: Multiplatform C library implementing the SSHv2 protocol (client and server). Vendored via the libssh-mirror submodule (upstream release baseline libssh-0.12.0). ESP-IDF-specific deltas live outside this tree under port/ and patches/.
+url: https://www.libssh.org/
+hash: 9b1ce58e5677921ca2815d4f39b42b282c87f12e
+cve-exclude-list:
+  - cve: CVE-2026-3731
+    reason: Resolved in 0.11.4 / 0.12.0; current pin is at or past 0.12.0.