[ptxdist] [PATCH 00/21] Add matching CPE identifiers

[ptxdist] [PATCH 00/21] Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Hello everyone,

recent 'cpe-check' report revealed some packages not being matched
correctly.  So I went over all packages of one of our BSPs and reviewed
all entries manually once.  This does not cover all packages provided by
ptxdist, but only those used by us.  However I guess at least some
packages are widely used, so maybe this is interesting for more people?!

Greets
Alex

Alexander Dahl (21):
  at91bootstrap2: Add matching CPE identifiers
  boost: Add matching CPE identfiers
  bzip2: Add matching CPE identifiers
  coreutils: Add matching CPE identifiers
  ethtool: Add matching CPE identifiers
  fcgi: Add matching CPE identifiers
  flex: Add matching CPE identifiers
  iperf3: Add matching CPE identifiers
  libarchive: Add matching CPE identifiers
  libgmp: Add matching CPE identifiers
  libmodbus: Add CPE identifiers
  libnl3: Reorder variables and re-add section header comment
  libnl3: Add matching CPE identifiers
  libpopt: Add matching CPE identifiers
  ncurses: Add matching CPE identifiers
  nlohmann-json: Add matching CPE identifiers
  openssl: Pin down CPE vendor
  sudo: Add matching CPE identifiers
  u-boot: Add matching CPE identities
  u-boot-tools: Add matching CPE identifiers
  zlib: Pin down CPE vendor

 rules/at91bootstrap2.make |  2 ++
 rules/boost.make          |  2 ++
 rules/bzip2.make          |  1 +
 rules/coreutils.make      |  1 +
 rules/ethtool.make        |  1 +
 rules/fcgi.make           |  1 +
 rules/flex.make           |  1 +
 rules/iperf3.make         |  1 +
 rules/libarchive.make     |  1 +
 rules/libgmp.make         |  1 +
 rules/libmodbus3.make     |  1 +
 rules/libnl3.make         | 12 +++++++++---
 rules/libpopt.make        |  1 +
 rules/ncurses.make        |  1 +
 rules/nlohmann-json.make  |  1 +
 rules/openssl.make        |  1 +
 rules/sudo.make           |  2 ++
 rules/u-boot-tools.make   |  1 +
 rules/u-boot.make         |  1 +
 rules/zlib.make           |  1 +
 20 files changed, 31 insertions(+), 3 deletions(-)


base-commit: c19a3c3a7191849f857ca396792ae919197ae9c8
-- 
2.47.3

[ptxdist] [PATCH 01/21] at91bootstrap2: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:linux4sam:at91bootstrap
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/at91bootstrap2.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/at91bootstrap2.make b/rules/at91bootstrap2.make
index 3cac2e59e..f1e89dd87 100644
--- a/rules/at91bootstrap2.make
+++ b/rules/at91bootstrap2.make
@@ -37,6 +37,8 @@ else
 AT91BOOTSTRAP2_LICENSE		:= unknown
 endif
 
+AT91BOOTSTRAP2_CVE_PRODUCT := linux4sam:at91bootstrap
+
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
-- 
2.47.3

[ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/boost.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/boost.make b/rules/boost.make
index a3b453efb..fbf6b477c 100644
--- a/rules/boost.make
+++ b/rules/boost.make
@@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
 BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
 BOOST_LICENSE	:= BSL-1.0
 BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
+BOOST_CVE_PRODUCT := boost:boost
+BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 03/21] bzip2: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:bzip:bzip2
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/bzip2.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/bzip2.make b/rules/bzip2.make
index 285fa351d..6eea9bbd8 100644
--- a/rules/bzip2.make
+++ b/rules/bzip2.make
@@ -26,6 +26,7 @@ BZIP2_SOURCE	:= $(SRCDIR)/$(BZIP2).$(BZIP2_SUFFIX)
 BZIP2_DIR	:= $(BUILDDIR)/$(BZIP2)
 BZIP2_LICENSE	:= bzip2-1.0.6
 BZIP2_LICENSE_FILES	:= file://LICENSE;md5=1e5cffe65fc786f83a11a4b225495c0b
+BZIP2_CVE_PRODUCT	:= bzip:bzip2
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 04/21] coreutils: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Non-default vendor.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/coreutils.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/coreutils.make b/rules/coreutils.make
index 74fb89a06..3102bfff1 100644
--- a/rules/coreutils.make
+++ b/rules/coreutils.make
@@ -23,6 +23,7 @@ COREUTILS_SOURCE	:= $(SRCDIR)/$(COREUTILS).$(COREUTILS_SUFFIX)
 COREUTILS_DIR		:= $(BUILDDIR)/$(COREUTILS)
 COREUTILS_LICENSE	:= GPL-3.0-or-later
 COREUTILS_LICENSE_FILES	:= file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464
+COREUTILS_CVE_PRODUCT	:= gnu:coreutils
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 05/21] ethtool: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:*:kernel:ethtool
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/ethtool.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/ethtool.make b/rules/ethtool.make
index 0b02c50e2..f4c1f7330 100644
--- a/rules/ethtool.make
+++ b/rules/ethtool.make
@@ -25,6 +25,7 @@ ETHTOOL_DIR	:= $(BUILDDIR)/$(ETHTOOL)
 ETHTOOL_LICENSE := GPL-2.0-only
 ETHTOOL_LICENSE_FILES	:= \
 	file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
+ETHTOOL_CVE_PRODUCT	:= kernel:ethtool
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 06/21] fcgi: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:fastcgi:fcgi
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/fcgi.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/fcgi.make b/rules/fcgi.make
index e65924f99..a8f2aa561 100644
--- a/rules/fcgi.make
+++ b/rules/fcgi.make
@@ -21,6 +21,7 @@ FCGI_SOURCE		:= $(SRCDIR)/$(FCGI).$(FCGI_SUFFIX)
 FCGI_DIR		:= $(BUILDDIR)/$(FCGI)
 FCGI_LICENSE		:= OML
 FCGI_LICENSE_FILES	:= file://LICENSE;md5=e3aacac3a647af6e7e31f181cda0a06a
+FCGI_CVE_PRODUCT	:= fastcgi:fcgi
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 07/21] flex: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:westes:flex
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/flex.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/flex.make b/rules/flex.make
index 4d54d91b2..76e0f4c95 100644
--- a/rules/flex.make
+++ b/rules/flex.make
@@ -24,6 +24,7 @@ FLEX_DIR	:= $(BUILDDIR)/$(FLEX)
 FLEX_LICENSE	:= BSD-2-Clause
 FLEX_LICENSE_FILES := \
 	file://COPYING;md5=e4742cf92e89040b39486a6219b68067
+FLEX_CVE_PRODUCT := westes:flex
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 08/21] iperf3: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pin down the vendor to avoid problems with the other iperf.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:es:iperf3
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/iperf3.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/iperf3.make b/rules/iperf3.make
index 059f62e3d..68621167b 100644
--- a/rules/iperf3.make
+++ b/rules/iperf3.make
@@ -23,6 +23,7 @@ IPERF3_SOURCE	:= $(SRCDIR)/$(IPERF3).$(IPERF3_SUFFIX)
 IPERF3_DIR	:= $(BUILDDIR)/$(IPERF3)
 IPERF3_LICENSE	:= BSD-3-Clause-LBNL AND MIT AND dtoa AND BSD-3-Clause AND NCSA AND public_domain
 IPERF3_LICENSE_FILES := file://LICENSE;md5=b51332d7f45357a9410daa9a14a3655f
+IPERF3_CVE_PRODUCT := es:iperf3
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 09/21] libarchive: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pick the correct lib by vendor.
Avoid conflict with other products named equally.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libarchive:libarchive
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libarchive.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libarchive.make b/rules/libarchive.make
index f293e25d5..862dd9246 100644
--- a/rules/libarchive.make
+++ b/rules/libarchive.make
@@ -24,6 +24,7 @@ LIBARCHIVE_DIR		:= $(BUILDDIR)/$(LIBARCHIVE)
 LIBARCHIVE_LICENSE	:= BSD-2-Clause AND BSD-3-Clause AND public_domain AND \
 			   (CC0-1.0 OR OpenSSL OR Apache-2.0)
 LIBARCHIVE_LICENSE_FILES	:= file://COPYING;md5=7ce08437ff7f5e24d72e666313ae4084
+LIBARCHIVE_CVE_PRODUCT	:= libarchive:libarchive
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 10/21] libgmp: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

The CPE database product name has no 'lib' prefix.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gmplib:gmp
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libgmp.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libgmp.make b/rules/libgmp.make
index 61067b526..3e21c3bcd 100644
--- a/rules/libgmp.make
+++ b/rules/libgmp.make
@@ -28,6 +28,7 @@ LIBGMP_LICENSE_FILES := \
 	file://COPYING.LESSERv3;md5=6a6a8e020838b23406c81b19c1d46df6 \
 	file://COPYINGv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 	file://COPYINGv3;md5=11cc2d3ee574f9d6b7ee797bdce4d423
+LIBGMP_CVE_PRODUCT := gmplib:gmp
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 11/21] libmodbus: Add CPE identifiers

[Alexander Dahl via ptxdist]

It is only libmodbus3 for packaging.  The CPE product is libmodbus for
the old and the new version.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libmodbus:libmodbus
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libmodbus3.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libmodbus3.make b/rules/libmodbus3.make
index 770bba3d8..8e1170f2e 100644
--- a/rules/libmodbus3.make
+++ b/rules/libmodbus3.make
@@ -25,6 +25,7 @@ LIBMODBUS3_LICENSE		:= LGPL-2.1-or-later
 LIBMODBUS3_LICENSE_FILES	:= \
 	file://COPYING.LESSER;md5=4fbd65380cdd255951079008b364516c \
 	file://src/modbus.c;startline=4;endline=4;md5=09383b02650315a322dba1dcf8aad811
+LIBMODBUS3_CVE_PRODUCT		:= libmodbus:libmodbus
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 12/21] libnl3: Reorder variables and re-add section header comment

[Alexander Dahl via ptxdist]

Some tidy up before adding new things.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libnl3.make | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/rules/libnl3.make b/rules/libnl3.make
index b1194b15d..c61fa9d35 100644
--- a/rules/libnl3.make
+++ b/rules/libnl3.make
@@ -22,14 +22,18 @@ LIBNL3_SUFFIX	:= tar.gz
 LIBNL3_URL	:= https://github.com/thom311/libnl/releases/download/$(LIBNL3_RELEASE)/$(LIBNL3).$(LIBNL3_SUFFIX)
 LIBNL3_SOURCE	:= $(SRCDIR)/$(LIBNL3).$(LIBNL3_SUFFIX)
 LIBNL3_DIR	:= $(BUILDDIR)/$(LIBNL3)
+
 LIBNL3_LICENSE	:= LGPL-2.1-only AND BSD-3-Clause
+ifdef PTXCONF_LIBNL3_ENABLE_CLI
+LIBNL3_LICENSE	+= AND GPL-2.0-only
+endif
 LIBNL3_LICENSE_FILES := \
 	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
 
-ifdef PTXCONF_LIBNL3_ENABLE_CLI
-LIBNL3_LICENSE	+= AND GPL-2.0-only
-endif
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
 
 #
 # autoconf
-- 
2.47.3

[ptxdist] [PATCH 13/21] libnl3: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

The package name with the appended version number prevents the package
to be found in the CPE database.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libnl3.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/libnl3.make b/rules/libnl3.make
index c61fa9d35..ad13a3bb3 100644
--- a/rules/libnl3.make
+++ b/rules/libnl3.make
@@ -31,6 +31,8 @@ LIBNL3_LICENSE_FILES := \
 	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
 
+LIBNL3_CVE_PRODUCT := libnl_project:libnl
+
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
-- 
2.47.3

[ptxdist] [PATCH 14/21] libpopt: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

This project does not use a 'lib' prefix in the CPE database.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libpopt.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libpopt.make b/rules/libpopt.make
index eacab63f0..29d127f14 100644
--- a/rules/libpopt.make
+++ b/rules/libpopt.make
@@ -25,6 +25,7 @@ LIBPOPT_SOURCE	:= $(SRCDIR)/$(LIBPOPT).$(LIBPOPT_SUFFIX)
 LIBPOPT_DIR	:= $(BUILDDIR)/$(LIBPOPT)
 LIBPOPT_LICENSE	:= MIT
 LIBPOPT_LICENSE_FILES := file://COPYING;md5=e0206ac9471d06667e076212db20c5f4
+LIBPOPT_CVE_PRODUCT := popt_project:popt
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 15/21] ncurses: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:invisible-island:ncurses
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/ncurses.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/ncurses.make b/rules/ncurses.make
index c3cb18c5f..99e41d409 100644
--- a/rules/ncurses.make
+++ b/rules/ncurses.make
@@ -24,6 +24,7 @@ NCURSES_DIR		:= $(BUILDDIR)/$(NCURSES)
 READLINE_BUILD_OOT	:= YES
 NCURSES_LICENSE		:= MIT
 NCURSES_LICENSE_FILES	:= file://COPYING;md5=7743fde124d1ceeaf6eb1100c49fcf6c
+NCURSES_CVE_PRODUCT	:= invisible-island:ncurses
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 16/21] nlohmann-json: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Upstream author Niels Lohmann just calls the project 'json', which makes
it somewhat hard for packaging.  We obviously need to explicitly set
vendor and product to the ones used in the CPE database in this case.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:nlohmann:json
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/nlohmann-json.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/nlohmann-json.make b/rules/nlohmann-json.make
index 28693d680..29bd579f9 100644
--- a/rules/nlohmann-json.make
+++ b/rules/nlohmann-json.make
@@ -23,6 +23,7 @@ NLOHMANN_JSON_SOURCE	:= $(SRCDIR)/$(NLOHMANN_JSON).$(NLOHMANN_JSON_SUFFIX)
 NLOHMANN_JSON_DIR	:= $(BUILDDIR)/$(NLOHMANN_JSON)
 NLOHMANN_JSON_LICENSE	:= MIT
 NLOHMANN_JSON_LICENSE_FILES := file://LICENSE.MIT;md5=3b489645de9825cca5beeb9a7e18b6eb
+NLOHMANN_JSON_CVE_PRODUCT := nlohmann:json
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 17/21] openssl: Pin down CPE vendor

[Alexander Dahl via ptxdist]

Avoid ambiguity by pinning down the vendor part.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:openssl:openssl
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/openssl.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/openssl.make b/rules/openssl.make
index 53d3ee5f3..2c60f127a 100644
--- a/rules/openssl.make
+++ b/rules/openssl.make
@@ -29,6 +29,7 @@ OPENSSL_DIR		:= $(BUILDDIR)/$(OPENSSL)
 OPENSSL_LICENSE		:= Apache-2.0
 OPENSSL_LICENSE_FILES	:= \
 	file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04
+OPENSSL_CVE_PRODUCT	:= openssl:openssl
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 18/21] sudo: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Pin down the vendor and split up the version.  Correctly matches now.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:sudo_project:sudo
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/sudo.make | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/sudo.make b/rules/sudo.make
index 05d872487..3ba1ed570 100644
--- a/rules/sudo.make
+++ b/rules/sudo.make
@@ -26,6 +26,8 @@ SUDO_SOURCE	:= $(SRCDIR)/$(SUDO).$(SUDO_SUFFIX)
 SUDO_DIR	:= $(BUILDDIR)/$(SUDO)
 SUDO_LICENSE	:= ISC AND BSD-3-Clause AND BSD-2-Clause-NetBSD AND Zlib
 SUDO_LICENSE_FILES := file://LICENSE.md;md5=2841c822e587db145364ca95e9be2ffa
+SUDO_CVE_PRODUCT := sudo_project:sudo
+SUDO_CVE_VERSION := $(subst p,:p,$(SUDO_VERSION))
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 19/21] u-boot: Add matching CPE identities

[Alexander Dahl via ptxdist]

Pin it down.  Can be used by u-boot-tools later.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:denx:u-boot
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/u-boot.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/u-boot.make b/rules/u-boot.make
index d3ea65cf2..68de9774a 100644
--- a/rules/u-boot.make
+++ b/rules/u-boot.make
@@ -26,6 +26,7 @@ U_BOOT_DIR		:= $(BUILDDIR)/$(U_BOOT)
 U_BOOT_BUILD_DIR	:= $(U_BOOT_DIR)$(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,-build)
 U_BOOT_DEVPKG		:= NO
 U_BOOT_BUILD_OOT	:= $(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,KEEP,NO)
+U_BOOT_CVE_PRODUCT	:= denx:u-boot
 
 ifdef PTXCONF_U_BOOT_CONFIGSYSTEM_KCONFIG
 U_BOOT_CONFIG	:= $(call ptx/in-platformconfigdir, \
-- 
2.47.3

[ptxdist] [PATCH 20/21] u-boot-tools: Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Built from the same source as u-boot.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/u-boot-tools.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/u-boot-tools.make b/rules/u-boot-tools.make
index dff2c1584..c09454a51 100644
--- a/rules/u-boot-tools.make
+++ b/rules/u-boot-tools.make
@@ -26,6 +26,7 @@ U_BOOT_TOOLS_LICENSE	:= GPL-2.0-or-later AND Zlib
 U_BOOT_TOOLS_LICENSE_FILES := \
 	file://Licenses/gpl-2.0.txt;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 	file://include/u-boot/zlib.h;startline=15;endline=42;md5=0ce30a522a630f7e637ea6d74422b320
+U_BOOT_TOOLS_CVE_PRODUCT := $(U_BOOT_CVE_PRODUCT)
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

[ptxdist] [PATCH 21/21] zlib: Pin down CPE vendor

[Alexander Dahl via ptxdist]

Avoid conflicts with different vendors.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:zlib:zlib
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/zlib.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/zlib.make b/rules/zlib.make
index d5f9240ad..0960b0f65 100644
--- a/rules/zlib.make
+++ b/rules/zlib.make
@@ -28,6 +28,7 @@ ZLIB_DIR	:= $(BUILDDIR)/$(ZLIB)
 ZLIB_LICENSE	:= Zlib
 ZLIB_LICENSE_FILES := \
 	file://LICENSE;md5=66e4e749bb11d80fc7ba510a9ce99534
+ZLIB_CVE_PRODUCT := zlib:zlib
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Alexander Dahl via ptxdist]

Hello,

Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/boost.make | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb..fbf6b477c 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
>  BOOST_LICENSE	:= BSL-1.0
>  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
> +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))

Maybe it's better to set BOOST_VERSION to the variant with dots like
1.89.0 and use `subst` for $(BOOST)?  This way file and folder names
stay the same as before like 1_89_0 and the variant in the usual
format with dots ends up in for example SBOM files?

An alternative section would look like this:

    BOOST_VERSION   := 1.89.0
    BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
    BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
    BOOST_SUFFIX    := tar.bz2
    BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
    BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
    BOOST_DIR       := $(BUILDDIR)/$(BOOST)
    BOOST_LICENSE   := BSL-1.0
    BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
    BOOST_CVE_PRODUCT := boost:boost

Note, we can add the subfolder in BOOST_URL now, one less redirect.

Not sure if I thought about all implications though. ^^

Greets
Alex

Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Michael Olbrich]

On Wed, Sep 16, 2026 at 03:53:38PM +0200, Alexander Dahl via ptxdist wrote:
> Hello,
> 
> Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> > Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> > Signed-off-by: Alexander Dahl <ada@thorsis.com>
> > ---
> >  rules/boost.make | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/rules/boost.make b/rules/boost.make
> > index a3b453efb..fbf6b477c 100644
> > --- a/rules/boost.make
> > +++ b/rules/boost.make
> > @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
> >  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
> >  BOOST_LICENSE	:= BSL-1.0
> >  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> > +BOOST_CVE_PRODUCT := boost:boost
> > +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
> 
> Maybe it's better to set BOOST_VERSION to the variant with dots like
> 1.89.0 and use `subst` for $(BOOST)?

I like that better. In general I think we should avoid having a different
version and CVE_VERSION if possible. I think the only exception should be
things like openssh where the version is split into two parts.

> This way file and folder names
> stay the same as before like 1_89_0 and the variant in the usual
> format with dots ends up in for example SBOM files?

I don't think the folder name really matters, but the source file name
should stay the same.

> An alternative section would look like this:
> 
>     BOOST_VERSION   := 1.89.0
>     BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
>     BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
>     BOOST_SUFFIX    := tar.bz2
>     BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
>     BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>     BOOST_DIR       := $(BUILDDIR)/$(BOOST)
>     BOOST_LICENSE   := BSL-1.0
>     BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
>     BOOST_CVE_PRODUCT := boost:boost
> 
> Note, we can add the subfolder in BOOST_URL now, one less redirect.

That is a nice side effect.

> Not sure if I thought about all implications though. ^^

I don't think there are any other relevant effects, so please send a patch
that changes the BOOST_VERSION instead.

Regards,
Michael

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [ptxdist] [PATCH 20/21] u-boot-tools: Add matching CPE identifiers

[Michael Olbrich]

On Mon, Sep 14, 2026 at 02:13:06PM +0200, Alexander Dahl via ptxdist wrote:
> Built from the same source as u-boot.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  rules/u-boot-tools.make | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/rules/u-boot-tools.make b/rules/u-boot-tools.make
> index dff2c1584..c09454a51 100644
> --- a/rules/u-boot-tools.make
> +++ b/rules/u-boot-tools.make
> @@ -26,6 +26,7 @@ U_BOOT_TOOLS_LICENSE	:= GPL-2.0-or-later AND Zlib
>  U_BOOT_TOOLS_LICENSE_FILES := \
>  	file://Licenses/gpl-2.0.txt;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>  	file://include/u-boot/zlib.h;startline=15;endline=42;md5=0ce30a522a630f7e637ea6d74422b320
> +U_BOOT_TOOLS_CVE_PRODUCT := $(U_BOOT_CVE_PRODUCT)

Must be '=' instead of ':=' because that relies on the include order and
that is not guaranteed. I'll fix it when I apply the patch.

Michael

>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> -- 
> 2.47.3
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [ptxdist] [APPLIED] at91bootstrap2: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 96bd2471ce1477f9ec29dd2c86f1a2f783c58263.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:23 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:linux4sam:at91bootstrap
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-2-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/at91bootstrap2.make b/rules/at91bootstrap2.make
> index 3cac2e59e405..f1e89dd87ca6 100644
> --- a/rules/at91bootstrap2.make
> +++ b/rules/at91bootstrap2.make
> @@ -37,6 +37,8 @@ else
>  AT91BOOTSTRAP2_LICENSE		:= unknown
>  endif
>  
> +AT91BOOTSTRAP2_CVE_PRODUCT := linux4sam:at91bootstrap
> +
>  # ----------------------------------------------------------------------------
>  # Prepare
>  # ----------------------------------------------------------------------------

Re: [ptxdist] [APPLIED] bzip2: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as ded13d444e7ed2c0219bd153d4b4acf7e0ea7685.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:24 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:bzip:bzip2
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-4-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/bzip2.make b/rules/bzip2.make
> index 285fa351d687..6eea9bbd8838 100644
> --- a/rules/bzip2.make
> +++ b/rules/bzip2.make
> @@ -26,6 +26,7 @@ BZIP2_SOURCE	:= $(SRCDIR)/$(BZIP2).$(BZIP2_SUFFIX)
>  BZIP2_DIR	:= $(BUILDDIR)/$(BZIP2)
>  BZIP2_LICENSE	:= bzip2-1.0.6
>  BZIP2_LICENSE_FILES	:= file://LICENSE;md5=1e5cffe65fc786f83a11a4b225495c0b
> +BZIP2_CVE_PRODUCT	:= bzip:bzip2
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] coreutils: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 20211988ed4b5e38adf36b53583e864a8676d302.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:25 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Non-default vendor.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-5-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/coreutils.make b/rules/coreutils.make
> index 74fb89a067df..3102bfff18ae 100644
> --- a/rules/coreutils.make
> +++ b/rules/coreutils.make
> @@ -23,6 +23,7 @@ COREUTILS_SOURCE	:= $(SRCDIR)/$(COREUTILS).$(COREUTILS_SUFFIX)
>  COREUTILS_DIR		:= $(BUILDDIR)/$(COREUTILS)
>  COREUTILS_LICENSE	:= GPL-3.0-or-later
>  COREUTILS_LICENSE_FILES	:= file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464
> +COREUTILS_CVE_PRODUCT	:= gnu:coreutils
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] ethtool: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as af25f4e76390d22b7869c2f64c7998f405772b16.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:26 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:*:kernel:ethtool
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-6-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/ethtool.make b/rules/ethtool.make
> index 0b02c50e2f4a..f4c1f7330113 100644
> --- a/rules/ethtool.make
> +++ b/rules/ethtool.make
> @@ -25,6 +25,7 @@ ETHTOOL_DIR	:= $(BUILDDIR)/$(ETHTOOL)
>  ETHTOOL_LICENSE := GPL-2.0-only
>  ETHTOOL_LICENSE_FILES	:= \
>  	file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
> +ETHTOOL_CVE_PRODUCT	:= kernel:ethtool
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] fcgi: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 4d9110e6f623be39eb40d136f15509d30c0b4ff9.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:27 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:fastcgi:fcgi
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-7-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/fcgi.make b/rules/fcgi.make
> index e65924f99700..a8f2aa56160a 100644
> --- a/rules/fcgi.make
> +++ b/rules/fcgi.make
> @@ -21,6 +21,7 @@ FCGI_SOURCE		:= $(SRCDIR)/$(FCGI).$(FCGI_SUFFIX)
>  FCGI_DIR		:= $(BUILDDIR)/$(FCGI)
>  FCGI_LICENSE		:= OML
>  FCGI_LICENSE_FILES	:= file://LICENSE;md5=e3aacac3a647af6e7e31f181cda0a06a
> +FCGI_CVE_PRODUCT	:= fastcgi:fcgi
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] flex: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as fcd0ff88d795b8e9e8741effea3d5ecd3e97286c.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:27 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:westes:flex
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-8-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/flex.make b/rules/flex.make
> index 4d54d91b21e1..76e0f4c95e43 100644
> --- a/rules/flex.make
> +++ b/rules/flex.make
> @@ -24,6 +24,7 @@ FLEX_DIR	:= $(BUILDDIR)/$(FLEX)
>  FLEX_LICENSE	:= BSD-2-Clause
>  FLEX_LICENSE_FILES := \
>  	file://COPYING;md5=e4742cf92e89040b39486a6219b68067
> +FLEX_CVE_PRODUCT := westes:flex
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] iperf3: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 9eb499f3375365193734d6e62ea6b58505743529.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:28 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Pin down the vendor to avoid problems with the other iperf.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:es:iperf3
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-9-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/iperf3.make b/rules/iperf3.make
> index 059f62e3dee0..68621167bacb 100644
> --- a/rules/iperf3.make
> +++ b/rules/iperf3.make
> @@ -23,6 +23,7 @@ IPERF3_SOURCE	:= $(SRCDIR)/$(IPERF3).$(IPERF3_SUFFIX)
>  IPERF3_DIR	:= $(BUILDDIR)/$(IPERF3)
>  IPERF3_LICENSE	:= BSD-3-Clause-LBNL AND MIT AND dtoa AND BSD-3-Clause AND NCSA AND public_domain
>  IPERF3_LICENSE_FILES := file://LICENSE;md5=b51332d7f45357a9410daa9a14a3655f
> +IPERF3_CVE_PRODUCT := es:iperf3
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] libarchive: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as d99d6a77eeb629859f1eeaaad99955038dc3e6de.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:29 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Pick the correct lib by vendor.
> Avoid conflict with other products named equally.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libarchive:libarchive
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-10-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libarchive.make b/rules/libarchive.make
> index f293e25d5de5..862dd9246d1a 100644
> --- a/rules/libarchive.make
> +++ b/rules/libarchive.make
> @@ -24,6 +24,7 @@ LIBARCHIVE_DIR		:= $(BUILDDIR)/$(LIBARCHIVE)
>  LIBARCHIVE_LICENSE	:= BSD-2-Clause AND BSD-3-Clause AND public_domain AND \
>  			   (CC0-1.0 OR OpenSSL OR Apache-2.0)
>  LIBARCHIVE_LICENSE_FILES	:= file://COPYING;md5=7ce08437ff7f5e24d72e666313ae4084
> +LIBARCHIVE_CVE_PRODUCT	:= libarchive:libarchive
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] libgmp: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 5272bcfa272e14cf169f43268b4b15293c564e13.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:30 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> The CPE database product name has no 'lib' prefix.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gmplib:gmp
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-11-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libgmp.make b/rules/libgmp.make
> index 61067b5261f2..3e21c3bcde8c 100644
> --- a/rules/libgmp.make
> +++ b/rules/libgmp.make
> @@ -28,6 +28,7 @@ LIBGMP_LICENSE_FILES := \
>  	file://COPYING.LESSERv3;md5=6a6a8e020838b23406c81b19c1d46df6 \
>  	file://COPYINGv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>  	file://COPYINGv3;md5=11cc2d3ee574f9d6b7ee797bdce4d423
> +LIBGMP_CVE_PRODUCT := gmplib:gmp
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] libmodbus: Add CPE identifiers

[Michael Olbrich]

Thanks, applied as 3b847cbd237b8ea84c128ef158b4a08e38e59ae0.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:31 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> It is only libmodbus3 for packaging.  The CPE product is libmodbus for
> the old and the new version.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libmodbus:libmodbus
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-12-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libmodbus3.make b/rules/libmodbus3.make
> index 770bba3d8419..8e1170f2e367 100644
> --- a/rules/libmodbus3.make
> +++ b/rules/libmodbus3.make
> @@ -25,6 +25,7 @@ LIBMODBUS3_LICENSE		:= LGPL-2.1-or-later
>  LIBMODBUS3_LICENSE_FILES	:= \
>  	file://COPYING.LESSER;md5=4fbd65380cdd255951079008b364516c \
>  	file://src/modbus.c;startline=4;endline=4;md5=09383b02650315a322dba1dcf8aad811
> +LIBMODBUS3_CVE_PRODUCT		:= libmodbus:libmodbus
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] libnl3: Reorder variables and re-add section header comment

[Michael Olbrich]

Thanks, applied as 1e3a97706ac86eae342fd672e6978dc60e6a3a62.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:32 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Some tidy up before adding new things.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-13-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libnl3.make b/rules/libnl3.make
> index b1194b15d601..c61fa9d35456 100644
> --- a/rules/libnl3.make
> +++ b/rules/libnl3.make
> @@ -22,14 +22,18 @@ LIBNL3_SUFFIX	:= tar.gz
>  LIBNL3_URL	:= https://github.com/thom311/libnl/releases/download/$(LIBNL3_RELEASE)/$(LIBNL3).$(LIBNL3_SUFFIX)
>  LIBNL3_SOURCE	:= $(SRCDIR)/$(LIBNL3).$(LIBNL3_SUFFIX)
>  LIBNL3_DIR	:= $(BUILDDIR)/$(LIBNL3)
> +
>  LIBNL3_LICENSE	:= LGPL-2.1-only AND BSD-3-Clause
> +ifdef PTXCONF_LIBNL3_ENABLE_CLI
> +LIBNL3_LICENSE	+= AND GPL-2.0-only
> +endif
>  LIBNL3_LICENSE_FILES := \
>  	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
>  	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
>  
> -ifdef PTXCONF_LIBNL3_ENABLE_CLI
> -LIBNL3_LICENSE	+= AND GPL-2.0-only
> -endif
> +# ----------------------------------------------------------------------------
> +# Prepare
> +# ----------------------------------------------------------------------------
>  
>  #
>  # autoconf

Re: [ptxdist] [APPLIED] libnl3: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 0e0c97206986e73b48ef70060e9bd302a97e22fd.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:33 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> The package name with the appended version number prevents the package
> to be found in the CPE database.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-14-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libnl3.make b/rules/libnl3.make
> index c61fa9d35456..ad13a3bb32ff 100644
> --- a/rules/libnl3.make
> +++ b/rules/libnl3.make
> @@ -31,6 +31,8 @@ LIBNL3_LICENSE_FILES := \
>  	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
>  	file://lib/xfrm/ae.c;startline=3;endline=32;md5=6813917a92b539b07534e1a79f5a6aca
>  
> +LIBNL3_CVE_PRODUCT := libnl_project:libnl
> +
>  # ----------------------------------------------------------------------------
>  # Prepare
>  # ----------------------------------------------------------------------------

Re: [ptxdist] [APPLIED] libpopt: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as ad5db520ab19cf0cf164a3b104ca14b2fcbeea6f.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:34 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> This project does not use a 'lib' prefix in the CPE database.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-15-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libpopt.make b/rules/libpopt.make
> index eacab63f0c91..29d127f1448b 100644
> --- a/rules/libpopt.make
> +++ b/rules/libpopt.make
> @@ -25,6 +25,7 @@ LIBPOPT_SOURCE	:= $(SRCDIR)/$(LIBPOPT).$(LIBPOPT_SUFFIX)
>  LIBPOPT_DIR	:= $(BUILDDIR)/$(LIBPOPT)
>  LIBPOPT_LICENSE	:= MIT
>  LIBPOPT_LICENSE_FILES := file://COPYING;md5=e0206ac9471d06667e076212db20c5f4
> +LIBPOPT_CVE_PRODUCT := popt_project:popt
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] ncurses: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 4bb64a1f21efe64af36fc7fd7d6cee858db07f6b.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:35 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:invisible-island:ncurses
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-16-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/ncurses.make b/rules/ncurses.make
> index c3cb18c5f691..99e41d4097a4 100644
> --- a/rules/ncurses.make
> +++ b/rules/ncurses.make
> @@ -24,6 +24,7 @@ NCURSES_DIR		:= $(BUILDDIR)/$(NCURSES)
>  READLINE_BUILD_OOT	:= YES
>  NCURSES_LICENSE		:= MIT
>  NCURSES_LICENSE_FILES	:= file://COPYING;md5=7743fde124d1ceeaf6eb1100c49fcf6c
> +NCURSES_CVE_PRODUCT	:= invisible-island:ncurses
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] nlohmann-json: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 5a64d25df18a529b74922a2afd3d5376bc3dac25.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:35 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Upstream author Niels Lohmann just calls the project 'json', which makes
> it somewhat hard for packaging.  We obviously need to explicitly set
> vendor and product to the ones used in the CPE database in this case.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:nlohmann:json
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-17-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/nlohmann-json.make b/rules/nlohmann-json.make
> index 28693d680547..29bd579f983e 100644
> --- a/rules/nlohmann-json.make
> +++ b/rules/nlohmann-json.make
> @@ -23,6 +23,7 @@ NLOHMANN_JSON_SOURCE	:= $(SRCDIR)/$(NLOHMANN_JSON).$(NLOHMANN_JSON_SUFFIX)
>  NLOHMANN_JSON_DIR	:= $(BUILDDIR)/$(NLOHMANN_JSON)
>  NLOHMANN_JSON_LICENSE	:= MIT
>  NLOHMANN_JSON_LICENSE_FILES := file://LICENSE.MIT;md5=3b489645de9825cca5beeb9a7e18b6eb
> +NLOHMANN_JSON_CVE_PRODUCT := nlohmann:json
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] openssl: Pin down CPE vendor

[Michael Olbrich]

Thanks, applied as 1c9dff6b990e76acab460c1312ae38e82fad5f17.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:36 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Avoid ambiguity by pinning down the vendor part.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:openssl:openssl
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-18-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/openssl.make b/rules/openssl.make
> index 53d3ee5f37de..2c60f127a1fb 100644
> --- a/rules/openssl.make
> +++ b/rules/openssl.make
> @@ -29,6 +29,7 @@ OPENSSL_DIR		:= $(BUILDDIR)/$(OPENSSL)
>  OPENSSL_LICENSE		:= Apache-2.0
>  OPENSSL_LICENSE_FILES	:= \
>  	file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04
> +OPENSSL_CVE_PRODUCT	:= openssl:openssl
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] sudo: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 4f10d126368f29dd1634e63c4726068b39899b73.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:37 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Pin down the vendor and split up the version.  Correctly matches now.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:sudo_project:sudo
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-19-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/sudo.make b/rules/sudo.make
> index 05d872487f2a..3ba1ed5705b9 100644
> --- a/rules/sudo.make
> +++ b/rules/sudo.make
> @@ -26,6 +26,8 @@ SUDO_SOURCE	:= $(SRCDIR)/$(SUDO).$(SUDO_SUFFIX)
>  SUDO_DIR	:= $(BUILDDIR)/$(SUDO)
>  SUDO_LICENSE	:= ISC AND BSD-3-Clause AND BSD-2-Clause-NetBSD AND Zlib
>  SUDO_LICENSE_FILES := file://LICENSE.md;md5=2841c822e587db145364ca95e9be2ffa
> +SUDO_CVE_PRODUCT := sudo_project:sudo
> +SUDO_CVE_VERSION := $(subst p,:p,$(SUDO_VERSION))
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] u-boot: Add matching CPE identities

[Michael Olbrich]

Thanks, applied as 49556239d5c0573f25039e709d86ae303bab9da4.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:38 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Pin it down.  Can be used by u-boot-tools later.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:denx:u-boot
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-20-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/u-boot.make b/rules/u-boot.make
> index d3ea65cf2a53..68de9774ae65 100644
> --- a/rules/u-boot.make
> +++ b/rules/u-boot.make
> @@ -26,6 +26,7 @@ U_BOOT_DIR		:= $(BUILDDIR)/$(U_BOOT)
>  U_BOOT_BUILD_DIR	:= $(U_BOOT_DIR)$(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,-build)
>  U_BOOT_DEVPKG		:= NO
>  U_BOOT_BUILD_OOT	:= $(call ptx/ifdef, PTXCONF_U_BOOT_BUILD_OOT,KEEP,NO)
> +U_BOOT_CVE_PRODUCT	:= denx:u-boot
>  
>  ifdef PTXCONF_U_BOOT_CONFIGSYSTEM_KCONFIG
>  U_BOOT_CONFIG	:= $(call ptx/in-platformconfigdir, \

Re: [ptxdist] [APPLIED] u-boot-tools: Add matching CPE identifiers

[Michael Olbrich]

Thanks, applied as 2b5fa5def65df85e4c78201be3ed96efb4b51b28.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:39 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Built from the same source as u-boot.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-21-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/u-boot-tools.make b/rules/u-boot-tools.make
> index dff2c1584737..aaf825ddbbc0 100644
> --- a/rules/u-boot-tools.make
> +++ b/rules/u-boot-tools.make
> @@ -26,6 +26,7 @@ U_BOOT_TOOLS_LICENSE	:= GPL-2.0-or-later AND Zlib
>  U_BOOT_TOOLS_LICENSE_FILES := \
>  	file://Licenses/gpl-2.0.txt;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>  	file://include/u-boot/zlib.h;startline=15;endline=42;md5=0ce30a522a630f7e637ea6d74422b320
> +U_BOOT_TOOLS_CVE_PRODUCT = $(U_BOOT_CVE_PRODUCT)
>  
>  # ----------------------------------------------------------------------------
>  # Prepare

Re: [ptxdist] [APPLIED] zlib: Pin down CPE vendor

[Michael Olbrich]

Thanks, applied as ade162504e6398a155d0345d577bf8af6f14a764.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:40 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Avoid conflicts with different vendors.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:zlib:zlib
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914121307.134745-22-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/zlib.make b/rules/zlib.make
> index d5f9240ad2e8..0960b0f65b1b 100644
> --- a/rules/zlib.make
> +++ b/rules/zlib.make
> @@ -28,6 +28,7 @@ ZLIB_DIR	:= $(BUILDDIR)/$(ZLIB)
>  ZLIB_LICENSE	:= Zlib
>  ZLIB_LICENSE_FILES := \
>  	file://LICENSE;md5=66e4e749bb11d80fc7ba510a9ce99534
> +ZLIB_CVE_PRODUCT := zlib:zlib
>  
>  # ----------------------------------------------------------------------------
>  # Prepare