Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Wed, Sep 16, 2026 at 03:53:38PM +0200, Alexander Dahl via ptxdist wrote:
> Hello,
> 
> Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> > Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> > Signed-off-by: Alexander Dahl <ada@thorsis.com>
> > ---
> >  rules/boost.make | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/rules/boost.make b/rules/boost.make
> > index a3b453efb..fbf6b477c 100644
> > --- a/rules/boost.make
> > +++ b/rules/boost.make
> > @@ -24,6 +24,8 @@ BOOST_SOURCE	:= $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
> >  BOOST_DIR	:= $(BUILDDIR)/$(BOOST)
> >  BOOST_LICENSE	:= BSL-1.0
> >  BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> > +BOOST_CVE_PRODUCT := boost:boost
> > +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
> 
> Maybe it's better to set BOOST_VERSION to the variant with dots like
> 1.89.0 and use `subst` for $(BOOST)?

I like that better. In general I think we should avoid having a different
version and CVE_VERSION if possible. I think the only exception should be
things like openssh where the version is split into two parts.

> This way file and folder names
> stay the same as before like 1_89_0 and the variant in the usual
> format with dots ends up in for example SBOM files?

I don't think the folder name really matters, but the source file name
should stay the same.

> An alternative section would look like this:
> 
>     BOOST_VERSION   := 1.89.0
>     BOOST_MD5       := e7414f68f1cb3fd834fc155c7a009aa6
>     BOOST           := boost_$(subst .,_,$(BOOST_VERSION))
>     BOOST_SUFFIX    := tar.bz2
>     BOOST_URL       := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
>     BOOST_SOURCE    := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
>     BOOST_DIR       := $(BUILDDIR)/$(BOOST)
>     BOOST_LICENSE   := BSL-1.0
>     BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
>     BOOST_CVE_PRODUCT := boost:boost
> 
> Note, we can add the subfolder in BOOST_URL now, one less redirect.

That is a nice side effect.

> Not sure if I thought about all implications though. ^^

I don't think there are any other relevant effects, so please send a patch
that changes the BOOST_VERSION instead.

Regards,
Michael

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |