Re: [Buildroot] [PATCH 0/7] Add PURL support

From: Peter Korsgaard <peter@korsgaard.com>
To: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Thomas Perale via buildroot <buildroot@buildroot.org>,
	Thomas Perale <thomas.perale@mind.be>,
	Christian Stewart <christian@aperture.us>,
	Thomas Perale <thomas.perale@essensium.com>
Subject: Re: [Buildroot] [PATCH 0/7] Add PURL support
Date: Tue, 22 Apr 2025 16:00:53 +0200	[thread overview]
Message-ID: <875xiwb8iy.fsf@dell.be.48ers.dk> (raw)
In-Reply-To: <20250422145324.01ae9635@windsurf> (Thomas Petazzoni's message of "Tue, 22 Apr 2025 14:53:24 +0200")

>>>>> "Thomas" == Thomas Petazzoni <thomas.petazzoni@bootlin.com> writes:

Hi,

 >> My series is more about improving the SBOM contents with information 
 >> that can be consumed by other software rather than improving
 >> 'pkg-stats' right now. But, it could be used as a fallback for
 >> packages without a CPE ID manually assigned.

 > And so DependencyTrack doesn't use CPEs at all? Or uses either CPEs or
 > PURLs, depending on the CVE?

If I get it correctly, dependencytrack has multiple vulnerability
sources, which do their lookups based on CPE OR PURL depending on the
source:

https://docs.dependencytrack.org/analysis-types/known-vulnerabilities/

It is not really clear to me how the github advisories are matched
against the components? I would think that those are more interesting
(E.G. applying more widely) than the subset of PURLs supported by
sonatype.

The documentation doesn't really say much:
https://docs.dependencytrack.org/datasources/github-advisories/

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot