Re: [ptxdist] [APPLIED] boost: Rework version and add matching CPE identfiers

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as d8093710d25d949b9dfe72398097e4fa82ea562e.

Michael

[sent from post-receive hook]

On Tue, 06 Oct 2026 09:01:17 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> The version format with dots is the one matched by CPE.  This way it is
> not necessary to override with <PKG>_CVE_VERSION.  The dotted variant is
> also better suited in SBOM for later use in CVE scanning tools.  Bonus:
> the changed download URL has less HTTP redirects.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260921104755.534119-2-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb051..013351972aca 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -15,15 +15,16 @@ PACKAGES-$(PTXCONF_BOOST) += boost
>  #
>  # Paths and names
>  #
> -BOOST_VERSION	:= 1_89_0
> +BOOST_VERSION	:= 1.89.0
>  BOOST_SHA256	:= 85a33fa22621b4f314f8e85e1a5e2a9363d22e4f4992925d4bb3bc631b5a0c7a
> -BOOST		:= boost_$(BOOST_VERSION)
> +BOOST		:= boost_$(subst .,_,$(BOOST_VERSION))
>  BOOST_SUFFIX	:= tar.bz2
> -BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST).$(BOOST_SUFFIX))
> +BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
>  BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
>  BOOST_LICENSE	:= BSL-1.0
>  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
>  
>  # ----------------------------------------------------------------------------
>  # Prepare