Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Alexander Dahl via ptxdist <ptxdist@pengutronix.de>]

Hello,

Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/boost.make | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb..fbf6b477c 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
>  BOOST_LICENSE	:= BSL-1.0
>  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
> +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))

Maybe it's better to set BOOST_VERSION to the variant with dots like
1.89.0 and use `subst` for $(BOOST)?  This way file and folder names
stay the same as before like 1_89_0 and the variant in the usual
format with dots ends up in for example SBOM files?

An alternative section would look like this:

    BOOST_VERSION   := 1.89.0
    BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
    BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
    BOOST_SUFFIX    := tar.bz2
    BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
    BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
    BOOST_DIR       := $(BUILDDIR)/$(BOOST)
    BOOST_LICENSE   := BSL-1.0
    BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
    BOOST_CVE_PRODUCT := boost:boost

Note, we can add the subfolder in BOOST_URL now, one less redirect.

Not sure if I thought about all implications though. ^^

Greets
Alex