From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 18 Sep 2026 11:02:07 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x7UTv-003VbK-07 for lore@lore.pengutronix.de; Fri, 18 Sep 2026 11:02:07 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x7UTu-0003eK-Eu; Fri, 18 Sep 2026 11:02:06 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x7UTb-0003du-Cf for ptxdist@pengutronix.de; Fri, 18 Sep 2026 11:01:47 +0200 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 57345200496 for ; Fri, 18 Sep 2026 11:01:47 +0200 (CEST) Received: from pty.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::c5]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x7UTb-001Xkc-0r for ptxdist@pengutronix.de; Fri, 18 Sep 2026 11:01:47 +0200 Received: from mol by pty.whiteo.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1x7UTb-00000003pBA-0jvA for ptxdist@pengutronix.de; Fri, 18 Sep 2026 11:01:47 +0200 Date: Fri, 18 Sep 2026 11:01:47 +0200 From: Michael Olbrich To: Alexander Dahl via ptxdist Message-ID: Mail-Followup-To: Alexander Dahl via ptxdist References: <20260914121307.134745-1-ada@thorsis.com> <20260914121307.134745-3-ada@thorsis.com> <20260916-shortage-evoke-e3f406644b3f@thorsis.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260916-shortage-evoke-e3f406644b3f@thorsis.com> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-IRC: #ptxdist @freenode X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=AWL,BAYES_00,SPF_HELO_NONE, SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [PATCH 02/21] boost: Add matching CPE identfiers X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false On Wed, Sep 16, 2026 at 03:53:38PM +0200, Alexander Dahl via ptxdist wrote: > Hello, > > Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist: > > Link: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost > > Signed-off-by: Alexander Dahl > > --- > > rules/boost.make | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/rules/boost.make b/rules/boost.make > > index a3b453efb..fbf6b477c 100644 > > --- a/rules/boost.make > > +++ b/rules/boost.make > > @@ -24,6 +24,8 @@ BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX) > > BOOST_DIR := $(BUILDDIR)/$(BOOST) > > BOOST_LICENSE := BSL-1.0 > > BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c > > +BOOST_CVE_PRODUCT := boost:boost > > +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION)) > > Maybe it's better to set BOOST_VERSION to the variant with dots like > 1.89.0 and use `subst` for $(BOOST)? I like that better. In general I think we should avoid having a different version and CVE_VERSION if possible. I think the only exception should be things like openssh where the version is split into two parts. > This way file and folder names > stay the same as before like 1_89_0 and the variant in the usual > format with dots ends up in for example SBOM files? I don't think the folder name really matters, but the source file name should stay the same. > An alternative section would look like this: > > BOOST_VERSION := 1.89.0 > BOOST_MD5 := e7414f68f1cb3fd834fc155c7a009aa6 > BOOST := boost_$(subst .,_,$(BOOST_VERSION)) > BOOST_SUFFIX := tar.bz2 > BOOST_URL := $(call ptx/mirror, SF, boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX)) > BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX) > BOOST_DIR := $(BUILDDIR)/$(BOOST) > BOOST_LICENSE := BSL-1.0 > BOOST_LICENSE_FILES := file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c > BOOST_CVE_PRODUCT := boost:boost > > Note, we can add the subfolder in BOOST_URL now, one less redirect. That is a nice side effect. > Not sure if I thought about all implications though. ^^ I don't think there are any other relevant effects, so please send a patch that changes the BOOST_VERSION instead. Regards, Michael -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |