--version and SLSA provenance report the build host's OpenSSL (pkg-config), not the linked one

[ChristianJucker]

Summary

When cbom-generator is built against a non-system OpenSSL (e.g.
-DOPENSSL_ROOT_DIR=… -DOPENSSL_USE_STATIC_LIBS=ON), CMake finds and links it
correctly, but the --version banner and the emitted provenance/SLSA documents
still report the build host's system OpenSSL — or even a hardcoded fallback.

Environment

• cbom-generator v1.9.4 (tag), built from source
• Ubuntu 24.04 (aarch64), GCC 13.3, CMake 3.28
• Custom static OpenSSL 3.5.4 (./Configure linux-aarch64 no-shared, private prefix)

Steps to reproduce

cmake -B build -DCMAKE_BUILD_TYPE=Release \
  -DOPENSSL_ROOT_DIR=$HOME/openssl35 -DOPENSSL_USE_STATIC_LIBS=ON
# configure output confirms the right library was resolved:
#   -- Found OpenSSL: .../openssl35/lib/libcrypto.a (found suitable version "3.5.4", minimum required is "3.0")
cmake --build build -j"$(nproc)"
./build/cbom-generator --version

Expected

OpenSSL: 3.5.4 — the version that was linked into the binary.

Actual

OpenSSL: 3.0.13 — the build host's distro OpenSSL.

Root cause (v1.9.4)

CMakeLists.txt captures the version from the host's pkg-config, not from the
OpenSSL that find_package resolved:

execute_process(
    COMMAND pkg-config --modversion openssl
    OUTPUT_VARIABLE CBOM_OPENSSL_VER
    OUTPUT_STRIP_TRAILING_WHITESPACE
    ERROR_QUIET
)
if(NOT CBOM_OPENSSL_VER)
    set(CBOM_OPENSSL_VER "3.0.2")  # Fallback to known version
endif()

pkg-config --modversion openssl answers with the system OpenSSL regardless of
OPENSSL_ROOT_DIR, and on hosts without an openssl .pc file the reported
version silently becomes the hardcoded 3.0.2. The value flows through
src/provenance.h.in (#define CBOM_OPENSSL_VERSION "@CBOM_OPENSSL_VER@")
into the --version banner, the provenance JSON openssl_version field, and
the SLSA provenance configuration.

Why it matters

For a CBOM/provenance tool this is more than cosmetic: every SLSA provenance
document emitted claims the tool was built with an OpenSSL version that may not
match the binary's actual crypto implementation — precisely the class of claim
these documents exist to make trustworthy.

Suggested fix

find_package(OpenSSL) already sets OPENSSL_VERSION (the CMakeLists even
validates it: if(OPENSSL_VERSION VERSION_LESS "3.0.0") …). Substituting that
variable in provenance.h.in and deleting the pkg-config/fallback block makes
the reported version follow whatever was actually resolved:

#define CBOM_OPENSSL_VERSION "@OPENSSL_VERSION@"

An even stronger alternative: query the linked library at runtime via
OpenSSL_version(OPENSSL_VERSION_STRING) (available ≥ 3.0, the project
minimum) — that value can never diverge from the binary, including when a
shared build is run against a different libcrypto than it was compiled against.

Happy to submit a PR for either variant (conventional-commit style per
CONTRIBUTING.md) — let me know which direction you prefer.