[ptxdist] [PATCH 00/21] Add matching CPE identifiers

[ptxdist] [PATCH 00/21] Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Hello everyone,

recent 'cpe-check' report revealed some packages not being matched
correctly.  So I went over all packages of one of our BSPs and reviewed
all entries manually once.  This does not cover all packages provided by
ptxdist, but only those used by us.  However I guess at least some
packages are widely used, so maybe this is interesting for more people?!

Greets
Alex

Alexander Dahl (21):
  at91bootstrap2: Add matching CPE identifiers
  boost: Add matching CPE identfiers
  bzip2: Add matching CPE identifiers
  coreutils: Add matching CPE identifiers
  ethtool: Add matching CPE identifiers
  fcgi: Add matching CPE identifiers
  flex: Add matching CPE identifiers
  iperf3: Add matching CPE identifiers
  libarchive: Add matching CPE identifiers
  libgmp: Add matching CPE identifiers
  libmodbus: Add CPE identifiers
  libnl3: Reorder variables and re-add section header comment
  libnl3: Add matching CPE identifiers
  libpopt: Add matching CPE identifiers
  ncurses: Add matching CPE identifiers
  nlohmann-json: Add matching CPE identifiers
  openssl: Pin down CPE vendor
  sudo: Add matching CPE identifiers
  u-boot: Add matching CPE identities
  u-boot-tools: Add matching CPE identifiers
  zlib: Pin down CPE vendor

 rules/at91bootstrap2.make |  2 ++
 rules/boost.make          |  2 ++
 rules/bzip2.make          |  1 +
 rules/coreutils.make      |  1 +
 rules/ethtool.make        |  1 +
 rules/fcgi.make           |  1 +
 rules/flex.make           |  1 +
 rules/iperf3.make         |  1 +
 rules/libarchive.make     |  1 +
 rules/libgmp.make         |  1 +
 rules/libmodbus3.make     |  1 +
 rules/libnl3.make         | 12 +++++++++---
 rules/libpopt.make        |  1 +
 rules/ncurses.make        |  1 +
 rules/nlohmann-json.make  |  1 +
 rules/openssl.make        |  1 +
 rules/sudo.make           |  2 ++
 rules/u-boot-tools.make   |  1 +
 rules/u-boot.make         |  1 +
 rules/zlib.make           |  1 +
 20 files changed, 31 insertions(+), 3 deletions(-)


base-commit: c19a3c3a7191849f857ca396792ae919197ae9c8
-- 
2.47.3

[ptxdist] [PATCH 01/21] at91bootstrap2: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:linux4sam:at91bootstrap
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/at91bootstrap2.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/at91bootstrap2.make b/rules/at91bootstrap2.make
index 3cac2e59e..f1e89dd87 100644
--- a/rules/at91bootstrap2.make
+++ b/rules/at91bootstrap2.make
@@ -37,6 +37,8 @@ else
 AT91BOOTSTRAP2_LICENSE		:= unknown
 endif
 
+AT91BOOTSTRAP2_CVE_PRODUCT := linux4sam:at91bootstrap
+
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
-- 
2.47.3

[ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/boost.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/boost.make b/rules/boost.make
index a3b453efb..fbf6b477c 100644
--- a/rules/boost.make
+++ b/rules/boost.make
@@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
 BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
 BOOST_LICENSE	:= BSL-1.0
 BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
+BOOST_CVE_PRODUCT := boost:boost
+BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Alexander Dahl via ptxdist]

Hello,

Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/boost.make | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb..fbf6b477c 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
>  BOOST_LICENSE	:= BSL-1.0
>  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
> +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))

Maybe it's better to set BOOST_VERSION to the variant with dots like
1.89.0 and use `subst` for $(BOOST)?  This way file and folder names
stay the same as before like 1_89_0 and the variant in the usual
format with dots ends up in for example SBOM files?

An alternative section would look like this:

    BOOST_VERSION   := 1.89.0
    BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
    BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
    BOOST_SUFFIX    := tar.bz2
    BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
    BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
    BOOST_DIR       := $(BUILDDIR)/$(BOOST)
    BOOST_LICENSE   := BSL-1.0
    BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
    BOOST_CVE_PRODUCT := boost:boost

Note, we can add the subfolder in BOOST_URL now, one less redirect.

Not sure if I thought about all implications though. ^^

Greets
Alex

Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Michael Olbrich]

On Wed, Sep 16, 2026 at 03:53:38PM +0200, Alexander Dahl via ptxdist wrote:
> Hello,
> 
> Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> > Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> > Signed-off-by: Alexander Dahl <ada@thorsis.com>
> > ---
> >  rules/boost.make | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/rules/boost.make b/rules/boost.make
> > index a3b453efb..fbf6b477c 100644
> > --- a/rules/boost.make
> > +++ b/rules/boost.make
> > @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
> >  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
> >  BOOST_LICENSE	:= BSL-1.0
> >  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> > +BOOST_CVE_PRODUCT := boost:boost
> > +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
> 
> Maybe it's better to set BOOST_VERSION to the variant with dots like
> 1.89.0 and use `subst` for $(BOOST)?

I like that better. In general I think we should avoid having a different
version and CVE_VERSION if possible. I think the only exception should be
things like openssh where the version is split into two parts.

> This way file and folder names
> stay the same as before like 1_89_0 and the variant in the usual
> format with dots ends up in for example SBOM files?

I don't think the folder name really matters, but the source file name
should stay the same.

> An alternative section would look like this:
> 
>     BOOST_VERSION   := 1.89.0
>     BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
>     BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
>     BOOST_SUFFIX    := tar.bz2
>     BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
>     BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>     BOOST_DIR       := $(BUILDDIR)/$(BOOST)
>     BOOST_LICENSE   := BSL-1.0
>     BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
>     BOOST_CVE_PRODUCT := boost:boost
> 
> Note, we can add the subfolder in BOOST_URL now, one less redirect.

That is a nice side effect.

> Not sure if I thought about all implications though. ^^

I don't think there are any other relevant effects, so please send a patch
that changes the BOOST_VERSION instead.

Regards,
Michael

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

[ptxdist] [PATCH 03/21] bzip2: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:bzip:bzip2
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/bzip2.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/bzip2.make b/rules/bzip2.make
index 285fa351d..6eea9bbd8 100644
--- a/rules/bzip2.make
+++ b/rules/bzip2.make
@@ -26,6 +26,7 @@ BZIP2_SOURCE	:= $(SRCDIR)/$(BZIP2).$(BZIP2_SUFFIX)
 BZIP2_DIR	:= $(BUILDDIR)/$(BZIP2)
 BZIP2_LICENSE	:= bzip2-1.0.6
 BZIP2_LICENSE_FILES	:= file://LICENSE;md5=1e5cffe65fc786f83a11a4b225495c0b
+BZIP2_CVE_PRODUCT	:= bzip:bzip2
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 04/21] coreutils: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Non-default vendor.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/coreutils.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/coreutils.make b/rules/coreutils.make
index 74fb89a06..3102bfff1 100644
--- a/rules/coreutils.make
+++ b/rules/coreutils.make
@@ -23,6 +23,7 @@ COREUTILS_SOURCE	:= $(SRCDIR)/$(COREUTILS).$(COREUTILS_SUFFIX)
 COREUTILS_DIR		:= $(BUILDDIR)/$(COREUTILS)
 COREUTILS_LICENSE	:= GPL-3.0-or-later
 COREUTILS_LICENSE_FILES	:= file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464
+COREUTILS_CVE_PRODUCT	:= gnu:coreutils
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 05/21] ethtool: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:*:kernel:ethtool
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/ethtool.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/ethtool.make b/rules/ethtool.make
index 0b02c50e2..f4c1f7330 100644
--- a/rules/ethtool.make
+++ b/rules/ethtool.make
@@ -25,6 +25,7 @@ ETHTOOL_DIR	:= $(BUILDDIR)/$(ETHTOOL)
 ETHTOOL_LICENSE := GPL-2.0-only
 ETHTOOL_LICENSE_FILES	:= \
 	file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
+ETHTOOL_CVE_PRODUCT	:= kernel:ethtool
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 06/21] fcgi: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:fastcgi:fcgi
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/fcgi.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/fcgi.make b/rules/fcgi.make
index e65924f99..a8f2aa561 100644
--- a/rules/fcgi.make
+++ b/rules/fcgi.make
@@ -21,6 +21,7 @@ FCGI_SOURCE		:= $(SRCDIR)/$(FCGI).$(FCGI_SUFFIX)
 FCGI_DIR		:= $(BUILDDIR)/$(FCGI)
 FCGI_LICENSE		:= OML
 FCGI_LICENSE_FILES	:= file://LICENSE;md5=e3aacac3a647af6e7e31f181cda0a06a
+FCGI_CVE_PRODUCT	:= fastcgi:fcgi
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 07/21] flex: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:westes:flex
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/flex.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/flex.make b/rules/flex.make
index 4d54d91b2..76e0f4c95 100644
--- a/rules/flex.make
+++ b/rules/flex.make
@@ -24,6 +24,7 @@ FLEX_DIR	:= $(BUILDDIR)/$(FLEX)
 FLEX_LICENSE	:= BSD-2-Clause
 FLEX_LICENSE_FILES := \
 	file://COPYING;md5=e4742cf92e89040b39486a6219b68067
+FLEX_CVE_PRODUCT := westes:flex
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 08/21] iperf3: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pin down the vendor to avoid problems with the other iperf.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:es:iperf3
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/iperf3.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/iperf3.make b/rules/iperf3.make
index 059f62e3d..68621167b 100644
--- a/rules/iperf3.make
+++ b/rules/iperf3.make
@@ -23,6 +23,7 @@ IPERF3_SOURCE	:= $(SRCDIR)/$(IPERF3).$(IPERF3_SUFFIX)
 IPERF3_DIR	:= $(BUILDDIR)/$(IPERF3)
 IPERF3_LICENSE	:= BSD-3-Clause-LBNL AND MIT AND dtoa AND BSD-3-Clause AND NCSA AND public_domain
 IPERF3_LICENSE_FILES := file://LICENSE;md5=b51332d7f45357a9410daa9a14a3655f
+IPERF3_CVE_PRODUCT := es:iperf3
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 09/21] libarchive: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pick the correct lib by vendor.
Avoid conflict with other products named equally.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libarchive:libarchive
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libarchive.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libarchive.make b/rules/libarchive.make
index f293e25d5..862dd9246 100644
--- a/rules/libarchive.make
+++ b/rules/libarchive.make
@@ -24,6 +24,7 @@ LIBARCHIVE_DIR		:= $(BUILDDIR)/$(LIBARCHIVE)
 LIBARCHIVE_LICENSE	:= BSD-2-Clause AND BSD-3-Clause AND public_domain AND \
 			   (CC0-1.0 OR OpenSSL OR Apache-2.0)
 LIBARCHIVE_LICENSE_FILES	:= file://COPYING;md5=7ce08437ff7f5e24d72e666313ae4084
+LIBARCHIVE_CVE_PRODUCT	:= libarchive:libarchive
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 10/21] libgmp: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

The CPE database product name has no 'lib' prefix.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gmplib:gmp
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libgmp.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libgmp.make b/rules/libgmp.make
index 61067b526..3e21c3bcd 100644
--- a/rules/libgmp.make
+++ b/rules/libgmp.make
@@ -28,6 +28,7 @@ LIBGMP_LICENSE_FILES := \
 	file://COPYING.LESSERv3;md5=6a6a8e020838b23406c81b19c1d46df6 \
 	file://COPYINGv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 	file://COPYINGv3;md5=11cc2d3ee574f9d6b7ee797bdce4d423
+LIBGMP_CVE_PRODUCT := gmplib:gmp
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 11/21] libmodbus: Add CPE identifiers

[Alexander Dahl via ptxdist]

It is only libmodbus3 for packaging.  The CPE product is libmodbus for
the old and the new version.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libmodbus:libmodbus
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libmodbus3.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libmodbus3.make b/rules/libmodbus3.make
index 770bba3d8..8e1170f2e 100644
--- a/rules/libmodbus3.make
+++ b/rules/libmodbus3.make
@@ -25,6 +25,7 @@ LIBMODBUS3_LICENSE		:= LGPL-2.1-or-later
 LIBMODBUS3_LICENSE_FILES	:= \
 	file://COPYING.LESSER;md5=4fbd65380cdd255951079008b364516c \
 	file://src/modbus.c;startline=4;endline=4;md5=09383b02650315a322dba1dcf8aad811
+LIBMODBUS3_CVE_PRODUCT		:= libmodbus:libmodbus
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 12/21] libnl3: Reorder variables and re-add section header comment

[Alexander Dahl via ptxdist]

Some tidy up before adding new things.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libnl3.make | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/rules/libnl3.make b/rules/libnl3.make
index b1194b15d..c61fa9d35 100644
--- a/rules/libnl3.make
+++ b/rules/libnl3.make
@@ -22,14 +22,18 @@ LIBNL3_SUFFIX	:= tar.gz
 LIBNL3_URL	:= https://github.com/thom311/libnl/releases/download/$(LIBNL3_RELEASE)/$(LIBNL3).$(LIBNL3_SUFFIX)
 LIBNL3_SOURCE	:= $(SRCDIR)/$(LIBNL3).$(LIBNL3_SUFFIX)
 LIBNL3_DIR	:= $(BUILDDIR)/$(LIBNL3)
+
 LIBNL3_LICENSE	:= LGPL-2.1-only AND BSD-3-Clause
+ifdef PTXCONF_LIBNL3_ENABLE_CLI
+LIBNL3_LICENSE	+= AND GPL-2.0-only
+endif
 LIBNL3_LICENSE_FILES := \
 	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
 
-ifdef PTXCONF_LIBNL3_ENABLE_CLI
-LIBNL3_LICENSE	+= AND GPL-2.0-only
-endif
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
 
 #
 # autoconf
-- 
2.47.3

[ptxdist] [PATCH 13/21] libnl3: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

The package name with the appended version number prevents the package
to be found in the CPE database.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libnl3.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/libnl3.make b/rules/libnl3.make
index c61fa9d35..ad13a3bb3 100644
--- a/rules/libnl3.make
+++ b/rules/libnl3.make
@@ -31,6 +31,8 @@ LIBNL3_LICENSE_FILES := \
 	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
 
+LIBNL3_CVE_PRODUCT := libnl_project:libnl
+
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
-- 
2.47.3

[ptxdist] [PATCH 14/21] libpopt: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

This project does not use a 'lib' prefix in the CPE database.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libpopt.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libpopt.make b/rules/libpopt.make
index eacab63f0..29d127f14 100644
--- a/rules/libpopt.make
+++ b/rules/libpopt.make
@@ -25,6 +25,7 @@ LIBPOPT_SOURCE	:= $(SRCDIR)/$(LIBPOPT).$(LIBPOPT_SUFFIX)
 LIBPOPT_DIR	:= $(BUILDDIR)/$(LIBPOPT)
 LIBPOPT_LICENSE	:= MIT
 LIBPOPT_LICENSE_FILES := file://COPYING;md5=e0206ac9471d06667e076212db20c5f4
+LIBPOPT_CVE_PRODUCT := popt_project:popt
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 15/21] ncurses: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:invisible-island:ncurses
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/ncurses.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/ncurses.make b/rules/ncurses.make
index c3cb18c5f..99e41d409 100644
--- a/rules/ncurses.make
+++ b/rules/ncurses.make
@@ -24,6 +24,7 @@ NCURSES_DIR		:= $(BUILDDIR)/$(NCURSES)
 READLINE_BUILD_OOT	:= YES
 NCURSES_LICENSE		:= MIT
 NCURSES_LICENSE_FILES	:= file://COPYING;md5=7743fde124d1ceeaf6eb1100c49fcf6c
+NCURSES_CVE_PRODUCT	:= invisible-island:ncurses
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 16/21] nlohmann-json: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Upstream author Niels Lohmann just calls the project 'json', which makes
it somewhat hard for packaging.  We obviously need to explicitly set
vendor and product to the ones used in the CPE database in this case.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:nlohmann:json
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/nlohmann-json.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/nlohmann-json.make b/rules/nlohmann-json.make
index 28693d680..29bd579f9 100644
--- a/rules/nlohmann-json.make
+++ b/rules/nlohmann-json.make
@@ -23,6 +23,7 @@ NLOHMANN_JSON_SOURCE	:= $(SRCDIR)/$(NLOHMANN_JSON).$(NLOHMANN_JSON_SUFFIX)
 NLOHMANN_JSON_DIR	:= $(BUILDDIR)/$(NLOHMANN_JSON)
 NLOHMANN_JSON_LICENSE	:= MIT
 NLOHMANN_JSON_LICENSE_FILES := file://LICENSE.MIT;md5=3b489645de9825cca5beeb9a7e18b6eb
+NLOHMANN_JSON_CVE_PRODUCT := nlohmann:json
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 17/21] openssl: Pin down CPE vendor

[Alexander Dahl via ptxdist]

Avoid ambiguity by pinning down the vendor part.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:openssl:openssl
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/openssl.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/openssl.make b/rules/openssl.make
index 53d3ee5f3..2c60f127a 100644
--- a/rules/openssl.make
+++ b/rules/openssl.make
@@ -29,6 +29,7 @@ OPENSSL_DIR		:= $(BUILDDIR)/$(OPENSSL)
 OPENSSL_LICENSE		:= Apache-2.0
 OPENSSL_LICENSE_FILES	:= \
 	file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04
+OPENSSL_CVE_PRODUCT	:= openssl:openssl
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 18/21] sudo: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pin down the vendor and split up the version.  Correctly matches now.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:sudo_project:sudo
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/sudo.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/sudo.make b/rules/sudo.make
index 05d872487..3ba1ed570 100644
--- a/rules/sudo.make
+++ b/rules/sudo.make
@@ -26,6 +26,8 @@ SUDO_SOURCE	:= $(SRCDIR)/$(SUDO).$(SUDO_SUFFIX)
 SUDO_DIR	:= $(BUILDDIR)/$(SUDO)
 SUDO_LICENSE	:= ISC AND BSD-3-Clause AND BSD-2-Clause-NetBSD AND Zlib
 SUDO_LICENSE_FILES := file://LICENSE.md;md5=2841c822e587db145364ca95e9be2ffa
+SUDO_CVE_PRODUCT := sudo_project:sudo
+SUDO_CVE_VERSION := $(subst p,:p,$(SUDO_VERSION))
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 19/21] u-boot: Add matching CPE identities

[Alexander Dahl via ptxdist]

Pin it down.  Can be used by u-boot-tools later.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:denx:u-boot
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/u-boot.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/u-boot.make b/rules/u-boot.make
index d3ea65cf2..68de9774a 100644
--- a/rules/u-boot.make
+++ b/rules/u-boot.make
@@ -26,6 +26,7 @@ U_BOOT_DIR		:= $(BUILDDIR)/$(U_BOOT)
 U_BOOT_BUILD_DIR	:= $(U_BOOT_DIR)$(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,-build)
 U_BOOT_DEVPKG		:= NO
 U_BOOT_BUILD_OOT	:= $(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,KEEP,NO)
+U_BOOT_CVE_PRODUCT	:= denx:u-boot
 
 ifdef PTXCONF_U_BOOT_CONFIGSYSTEM_KCONFIG
 U_BOOT_CONFIG	:= $(call ptx/in-platformconfigdir, \
-- 
2.47.3

[ptxdist] [PATCH 20/21] u-boot-tools: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Built from the same source as u-boot.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/u-boot-tools.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/u-boot-tools.make b/rules/u-boot-tools.make
index dff2c1584..c09454a51 100644
--- a/rules/u-boot-tools.make
+++ b/rules/u-boot-tools.make
@@ -26,6 +26,7 @@ U_BOOT_TOOLS_LICENSE	:= GPL-2.0-or-later AND Zlib
 U_BOOT_TOOLS_LICENSE_FILES := \
 	file://Licenses/gpl-2.0.txt;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 	file://include/u-boot/zlib.h;startline=15;endline=42;md5=0ce30a522a630f7e637ea6d74422b320
+U_BOOT_TOOLS_CVE_PRODUCT := $(U_BOOT_CVE_PRODUCT)
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

Re: [ptxdist] [PATCH 20/21] u-boot-tools: Add matching CPE identifiers

[Michael Olbrich]

On Mon, Sep 14, 2026 at 02:13:06PM +0200, Alexander Dahl via ptxdist wrote:
> Built from the same source as u-boot.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/u-boot-tools.make | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/rules/u-boot-tools.make b/rules/u-boot-tools.make
> index dff2c1584..c09454a51 100644
> --- a/rules/u-boot-tools.make
> +++ b/rules/u-boot-tools.make
> @@ -26,6 +26,7 @@ U_BOOT_TOOLS_LICENSE	:= GPL-2.0-or-later AND Zlib
>  U_BOOT_TOOLS_LICENSE_FILES := \
>  	file://Licenses/gpl-2.0.txt;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>  	file://include/u-boot/zlib.h;startline=15;endline=42;md5=0ce30a522a630f7e637ea6d74422b320
> +U_BOOT_TOOLS_CVE_PRODUCT := $(U_BOOT_CVE_PRODUCT)

Must be '=' instead of ':=' because that relies on the include order and
that is not guaranteed. I'll fix it when I apply the patch.

Michael

>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> -- 
> 2.47.3
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

[ptxdist] [PATCH 21/21] zlib: Pin down CPE vendor

[Alexander Dahl via ptxdist]

Avoid conflicts with different vendors.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:zlib:zlib
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/zlib.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/zlib.make b/rules/zlib.make
index d5f9240ad..0960b0f65 100644
--- a/rules/zlib.make
+++ b/rules/zlib.make
@@ -28,6 +28,7 @@ ZLIB_DIR	:= $(BUILDDIR)/$(ZLIB)
 ZLIB_LICENSE	:= Zlib
 ZLIB_LICENSE_FILES := \
 	file://LICENSE;md5=66e4e749bb11d80fc7ba510a9ce99534
+ZLIB_CVE_PRODUCT := zlib:zlib
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3