[ptxdist] [PATCH v2 0/1] Add matching CPE identifiers

[ptxdist] [PATCH v2 0/1] Add matching CPE identifiers

[Alexander Dahl via ptxdist]

Hello everyone,

this is v2 and only one patch for boost is left.
Reworked as discussed on v1.

Greets
Alex

Alexander Dahl (1):
  boost: Rework version and add matching CPE identfiers

 rules/boost.make | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)


base-commit: fcc12d5604b0b5761cfec6f81b1964677ce4566d
-- 
2.47.3

[ptxdist] [PATCH v2 1/1] boost: Rework version and add matching CPE identfiers

[Alexander Dahl via ptxdist]

The version format with dots is the one matched by CPE.  This way it is
not necessary to override with <PKG>_CVE_VERSION.  The dotted variant is
also better suited in SBOM for later use in CVE scanning tools.  Bonus:
the changed download URL has less HTTP redirects.

Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---

Notes:
    v2:
    - set version to the dotted variant and use subst on the filename instead
    - extended commit message

 rules/boost.make | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/rules/boost.make b/rules/boost.make
index a3b453efb..013351972 100644
--- a/rules/boost.make
+++ b/rules/boost.make
@@ -15,15 +15,16 @@ PACKAGES-$(PTXCONF_BOOST) += boost
 #
 # Paths and names
 #
-BOOST_VERSION	:= 1_89_0
+BOOST_VERSION	:= 1.89.0
 BOOST_SHA256	:= 85a33fa22621b4f314f8e85e1a5e2a9363d22e4f4992925d4bb3bc631b5a0c7a
-BOOST		:= boost_$(BOOST_VERSION)
+BOOST		:= boost_$(subst .,_,$(BOOST_VERSION))
 BOOST_SUFFIX	:= tar.bz2
-BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST).$(BOOST_SUFFIX))
+BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
 BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
 BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
 BOOST_LICENSE	:= BSL-1.0
 BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
+BOOST_CVE_PRODUCT := boost:boost
 
 # ----------------------------------------------------------------------------
 # Prepare
-- 
2.47.3

Re: [ptxdist] [APPLIED] boost: Rework version and add matching CPE identfiers

[Michael Olbrich]

Thanks, applied as d8093710d25d949b9dfe72398097e4fa82ea562e.

Michael

[sent from post-receive hook]

On Tue, 06 Oct 2026 09:01:17 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> The version format with dots is the one matched by CPE.  This way it is
> not necessary to override with <PKG>_CVE_VERSION.  The dotted variant is
> also better suited in SBOM for later use in CVE scanning tools.  Bonus:
> the changed download URL has less HTTP redirects.
> 
> Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260921104755.534119-2-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb051..013351972aca 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -15,15 +15,16 @@ PACKAGES-$(PTXCONF_BOOST) += boost
>  #
>  # Paths and names
>  #
> -BOOST_VERSION	:= 1_89_0
> +BOOST_VERSION	:= 1.89.0
>  BOOST_SHA256	:= 85a33fa22621b4f314f8e85e1a5e2a9363d22e4f4992925d4bb3bc631b5a0c7a
> -BOOST		:= boost_$(BOOST_VERSION)
> +BOOST		:= boost_$(subst .,_,$(BOOST_VERSION))
>  BOOST_SUFFIX	:= tar.bz2
> -BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST).$(BOOST_SUFFIX))
> +BOOST_URL	:= $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
>  BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
>  BOOST_LICENSE	:= BSL-1.0
>  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
>  
>  # ----------------------------------------------------------------------------
>  # Prepare