Re: [meta-virtualization] [PATCH] containerd: Remove leading "v" from PV

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Sun, Sep 07, 2025 at 04:19:17PM -0400, Bruce Ashfield via lists.yoctoproject.org wrote:
> On Sun, Sep 7, 2025 at 4:17 PM Bruce Ashfield <bruce.ashfield@gmail.com>
> wrote:
> > On Sun, Sep 7, 2025 at 6:59 AM Peter Kjellerstedt via
> > lists.yoctoproject.org <peter.kjellerstedt=axis.com@lists.yoctoproject.org>
> > wrote:
> >
> >> The leading "v" in the version otherwise makes its way into, e.g., the
> >> SBOM.
> >>
> >> Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
> >> ---
> >>
> >> There are another 30 recipes in meta-virtualization that have a leading
> >> "v" in their versions, but this is the only one of them that we use.
> >> I can send patches for the others as well if you want.
> >>
> >
> > No thanks, to any of them.
> >
> > The "v" isn't by mistake. I don't see any reason to remove it.
> >
> 
> What I mean by this, is that someone needs to tell me why SBOM
> is broken enough that it can't handle the "v", and what problems it
> causes in the SBOM.

At least CVE checking tooling can compare PV against version numbers
outside of yocto build environment which are often without
"v" prefix used by several projects in git tags. Same for the SW versions
reported by the tools in logs and/or command line.

I think the tools can handle "v" but different ways of reporting version
numbers break usecases if "v" is not used in all contexts like in CVE
reporting.

For example Debian doesn't report containerd versions with leading "v".

Cheers,

-Mikko