[OE-core][PATCH] u-boot-tools: add CVE_PRODUCT mapping

[OE-core][PATCH] u-boot-tools: add CVE_PRODUCT mapping

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The current inherited "u-boot-tools" identity has no vulnerability records even
though this recipe builds host utilities from the U-Boot source tree, so
source-aligned CVEs are missed.

Use "u-boot:u-boot" for the CNA affected-data identity and
"denx:u-boot" for the NVD dictionary CPE and configuration identity.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
index 9e7a178310..441d25bbc9 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
@@ -1,4 +1,6 @@
 require u-boot-common.inc
 require u-boot-tools.inc
 
+CVE_PRODUCT = "u-boot:u-boot denx:u-boot"
+
 SRC_URI += "file://0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch"
-- 
2.35.6

Re: [OE-core][PATCH] u-boot-tools: add CVE_PRODUCT mapping

[Quentin Schulz]

Hi Devansh,

On 8/24/26 1:01 PM, Devansh Patel via lists.openembedded.org wrote:
> From: Devansh Patel <devanshp@cisco.com>
> 
> The current inherited "u-boot-tools" identity has no vulnerability records even
> though this recipe builds host utilities from the U-Boot source tree, so
> source-aligned CVEs are missed.
> 
> Use "u-boot:u-boot" for the CNA affected-data identity and
> "denx:u-boot" for the NVD dictionary CPE and configuration identity.
> 

How about using a file that is included by both u-boot-tools and u-boot 
so that we don't have to not forget to update both?

u-boot-common.inc is included by both u-boot-tools.bb and u-boot.bb so 
that seems like an ideal candidate (if so, then we probably could remove 
CVE_PRODUCT from u-boot.inc?)

We only have denx:u-boot today in u-boot.inc, how did you come to the 
conclusion we also needed u-boot:u-boot?

Cheers,
Quentin

Re: [PATCH] u-boot-tools: add CVE_PRODUCT mapping

[Devansh Patel]

[-- Attachment #1: Type: text/plain, Size: 1780 bytes --]

On Mon, Aug 24, 2026 at 04:38 PM, Quentin Schulz wrote:

> 
> Hi Devansh,
> 
> On 8/24/26 1:01 PM, Devansh Patel via lists.openembedded.org wrote:
> 
>> From: Devansh Patel <devanshp@cisco.com>
>> 
>> The current inherited "u-boot-tools" identity has no vulnerability records
>> even
>> though this recipe builds host utilities from the U-Boot source tree, so
>> source-aligned CVEs are missed.
>> 
>> Use "u-boot:u-boot" for the CNA affected-data identity and
>> "denx:u-boot" for the NVD dictionary CPE and configuration identity.
> 
> How about using a file that is included by both u-boot-tools and u-boot
> so that we don't have to not forget to update both?
> 
> u-boot-common.inc is included by both u-boot-tools.bb and u-boot.bb so
> that seems like an ideal candidate (if so, then we probably could remove
> CVE_PRODUCT from u-boot.inc?)

Hi Quentin,
Thanks, I agree that u-boot-common.inc is the correct location. I will move the mapping there and remove it from u-boot.inc, so both recipes inherit it.

> 
> We only have denx:u-boot today in u-boot.inc, how did you come to the
> conclusion we also needed u-boot:u-boot?

u-boot:u-boot is not an NVD CPE. It comes from the authoritative CNA affected data for CVE-2026-29007, CVE-2026-29008, and CVE-2026-29009, where VulnCheck uses affected.vendor=u-boot and affected.product=u-boot.

OE-Core master’s sbom-cve-check consumes CVE List V5 affected data directly as well as NVD data. NVD currently also maps those three records to denx:u-boot, so the CNA token adds no exclusive CVEs today. Keeping it nevertheless allows CNA records to be matched while NVD enrichment is pending or absent. I will clarify that distinction in v2.

> 
> Cheers,
> Quentin

Regards,
Devansh Patel

[-- Attachment #2: Type: text/html, Size: 1963 bytes --]

Re: [PATCH] u-boot-tools: add CVE_PRODUCT mapping

[Devansh Patel]

[-- Attachment #1: Type: text/plain, Size: 239 bytes --]

Hi Quentin,
I have submitted the updated v2 patch here:
https://lists.openembedded.org/g/openembedded-core/topic/120907196
The mapping is now placed in u-boot-common.inc so both u-boot and u-boot-tools inherit it.

Regards,
Devansh

[-- Attachment #2: Type: text/html, Size: 413 bytes --]

[OE-core][PATCH v2] u-boot: share CVE_PRODUCT with u-boot-tools

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

u-boot-tools builds host utilities from the same source as u-boot, but it
does not inherit the existing CVE_PRODUCT assignment and falls back to its
unrecognized recipe-name identity.  Move the mapping to u-boot-common.inc
so both recipes inherit it.

Use "u-boot:u-boot" for the CNA/CVE List V5 affected-data identity and
"denx:u-boot" for the NVD dictionary CPE and configuration identity.  The
CNA records are also covered by NVD today, but retaining both authoritative
identities permits direct matching independently of NVD enrichment.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-common.inc | 2 ++
 meta/recipes-bsp/u-boot/u-boot.inc        | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index d82d42cbce..86c4fed2bc 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -10,6 +10,8 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
 PE = "1"
 
+CVE_PRODUCT = "u-boot:u-boot denx:u-boot"
+
 # We use the revision in order to avoid having to fetch it from the
 # repo during parse
 SRCREV = "ece349ade2973e220f524ce59e59711cc919263f"
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index 2197039dbc..b9f61a185c 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -21,8 +21,6 @@ PACKAGECONFIG ??= "openssl"
 # a host build dependency.
 PACKAGECONFIG[openssl] = ",,openssl-native"
 
-CVE_PRODUCT = "denx:u-boot"
-
 # Allow setting an additional version string that will be picked up by the
 # u-boot build system and appended to the u-boot version.  If the .scmversion
 # file already exists it will not be overwritten.
-- 
2.35.6