[ptxdist] [PATCH] doc: ref_make_variables: document new CVE variables

[ptxdist] [PATCH] doc: ref_make_variables: document new CVE variables

[Roland Hieber]

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
 doc/ref_make_variables.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/ref_make_variables.rst b/doc/ref_make_variables.rst
index 358701aab9e2..1c2f24b0db4d 100644
--- a/doc/ref_make_variables.rst
+++ b/doc/ref_make_variables.rst
@@ -256,6 +256,12 @@ Package Definition
   UTF-8 files the encoding can be specified with ``encoding=<enc>``.
   See the section :ref:`licensing_in_packages` for more information.
 
+``<PKG>_CVE_PRODUCT``, ``<PKG>_CVE_VERSION``
+  The product ID and the version number used in the `CVE Database
+  <https://www.cve.org>`__, used for generating SBoM reports.
+  These variables only need to be set if their values differ from ``<PKG>`` and
+  ``$(<PKG>_VERSION)`` respectively.
+
 For most packages the variables described above are undefined by default.
 However, for cross and host packages these variables default to the value
 of the corresponding target package if it exists.
-- 
2.39.5

Re: [ptxdist] [PATCH] doc: ref_make_variables: document new CVE variables

[Michael Olbrich]

On Fri, Feb 07, 2025 at 02:45:24PM +0100, Roland Hieber wrote:
> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
> ---
>  doc/ref_make_variables.rst | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/doc/ref_make_variables.rst b/doc/ref_make_variables.rst
> index 358701aab9e2..1c2f24b0db4d 100644
> --- a/doc/ref_make_variables.rst
> +++ b/doc/ref_make_variables.rst
> @@ -256,6 +256,12 @@ Package Definition
>    UTF-8 files the encoding can be specified with ``encoding=<enc>``.
>    See the section :ref:`licensing_in_packages` for more information.
>  
> +``<PKG>_CVE_PRODUCT``, ``<PKG>_CVE_VERSION``
> +  The product ID and the version number used in the `CVE Database
> +  <https://www.cve.org>`__, used for generating SBoM reports.
> +  These variables only need to be set if their values differ from ``<PKG>`` and
> +  ``$(<PKG>_VERSION)`` respectively.

<PKG>_CVE_PRODUCT can be <vendor>:<product> if necessary, and it can be a
list if multiple vendor/product combinations are needed. I think that
should be documented as well :-)...

Michael

> +
>  For most packages the variables described above are undefined by default.
>  However, for cross and host packages these variables default to the value
>  of the corresponding target package if it exists.
> -- 
> 2.39.5
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

[ptxdist] [PATCH v2] doc: ref_make_variables: document new CVE variables

[Roland Hieber]

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
v2:
 * separate blocks for each variable
 * mention <vendor>:<product> syntax and multiple values
---
 doc/ref_make_variables.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/ref_make_variables.rst b/doc/ref_make_variables.rst
index 358701aab9e2..bfd01098f517 100644
--- a/doc/ref_make_variables.rst
+++ b/doc/ref_make_variables.rst
@@ -256,6 +256,19 @@ Package Definition
   UTF-8 files the encoding can be specified with ``encoding=<enc>``.
   See the section :ref:`licensing_in_packages` for more information.
 
+``<PKG>_CVE_PRODUCT``
+  The product ID in the `CVE Database <https://www.cve.org>`__, used for
+  generating SBoM reports.
+  It can be of the form ``<vendor>:<product>`` and contain multiple values
+  separated by spaces if necessary.
+  If not set, it defaults to ``<PKG>``.
+
+``<PKG>_CVE_VERSION``
+  The version number in the `CVE Database <https://www.cve.org>`__, used for
+  generating SBoM reports.
+  If not set, it defaults to ``$(<PKG>_VERSION)``.
+  
+
 For most packages the variables described above are undefined by default.
 However, for cross and host packages these variables default to the value
 of the corresponding target package if it exists.
-- 
2.39.5

[ptxdist] [PATCH v3] doc: ref_make_variables: document new CVE variables

[Roland Hieber]

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
v3:
 * where did that extra empty line come from?

v2:
 * separate blocks for each variable
 * mention <vendor>:<product> syntax and multiple values
---
 doc/ref_make_variables.rst | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/doc/ref_make_variables.rst b/doc/ref_make_variables.rst
index 358701aab9e2..37748b09820e 100644
--- a/doc/ref_make_variables.rst
+++ b/doc/ref_make_variables.rst
@@ -256,6 +256,18 @@ Package Definition
   UTF-8 files the encoding can be specified with ``encoding=<enc>``.
   See the section :ref:`licensing_in_packages` for more information.
 
+``<PKG>_CVE_PRODUCT``
+  The product ID in the `CVE Database <https://www.cve.org>`__, used for
+  generating SBoM reports.
+  It can be of the form ``<vendor>:<product>`` and contain multiple values
+  separated by spaces if necessary.
+  If not set, it defaults to ``<PKG>``.
+
+``<PKG>_CVE_VERSION``
+  The version number in the `CVE Database <https://www.cve.org>`__, used for
+  generating SBoM reports.
+  If not set, it defaults to ``$(<PKG>_VERSION)``.
+
 For most packages the variables described above are undefined by default.
 However, for cross and host packages these variables default to the value
 of the corresponding target package if it exists.
-- 
2.39.5

Re: [ptxdist] [APPLIED] doc: ref_make_variables: document new CVE variables

[Michael Olbrich]

Thanks, applied as 304a45f58b04a931fb9e688b8ced3d8ae39587fc.

Michael

[sent from post-receive hook]

On Mon, 17 Feb 2025 08:24:27 +0100, Roland Hieber <rhi@pengutronix.de> wrote:
> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
> Message-Id: <20250210101102.363875-1-rhi@pengutronix.de>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/doc/ref_make_variables.rst b/doc/ref_make_variables.rst
> index 358701aab9e2..37748b09820e 100644
> --- a/doc/ref_make_variables.rst
> +++ b/doc/ref_make_variables.rst
> @@ -256,6 +256,18 @@ Package Definition
>    UTF-8 files the encoding can be specified with ``encoding=<enc>``.
>    See the section :ref:`licensing_in_packages` for more information.
>  
> +``<PKG>_CVE_PRODUCT``
> +  The product ID in the `CVE Database <https://www.cve.org>`__, used for
> +  generating SBoM reports.
> +  It can be of the form ``<vendor>:<product>`` and contain multiple values
> +  separated by spaces if necessary.
> +  If not set, it defaults to ``<PKG>``.
> +
> +``<PKG>_CVE_VERSION``
> +  The version number in the `CVE Database <https://www.cve.org>`__, used for
> +  generating SBoM reports.
> +  If not set, it defaults to ``$(<PKG>_VERSION)``.
> +
>  For most packages the variables described above are undefined by default.
>  However, for cross and host packages these variables default to the value
>  of the corresponding target package if it exists.