[Buildroot] [PATCH v2 1/2] package/libqmi: add _CPE_ID_VENDOR

[Buildroot] [PATCH v2 1/2] package/libqmi: add _CPE_ID_VENDOR

[Matt Weber]

cpe:2.3:a:libqmi_project:libqmi:* is a valid CPE identifier for this package:

 https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3:a:libqmi_project:libqmi

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>

---
v2 - added SOB and moved variable assignment under license files
---
 package/libqmi/libqmi.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/libqmi/libqmi.mk b/package/libqmi/libqmi.mk
index 4b430d11f8..6fc6d4a50d 100644
--- a/package/libqmi/libqmi.mk
+++ b/package/libqmi/libqmi.mk
@@ -9,6 +9,7 @@ LIBQMI_SITE = http://www.freedesktop.org/software/libqmi
 LIBQMI_SOURCE = libqmi-$(LIBQMI_VERSION).tar.xz
 LIBQMI_LICENSE = LGPL-2.0+ (library), GPL-2.0+ (programs)
 LIBQMI_LICENSE_FILES = COPYING COPYING.LIB
+LIBQMI_CPE_ID_VENDOR = libqmi_project
 LIBQMI_INSTALL_STAGING = YES
 
 LIBQMI_DEPENDENCIES = libglib2
-- 
2.17.1

[Buildroot] [PATCH v2 2/2] support/scripts/pkg-stats: add CPE searching links

[Matt Weber]

For cases of a CPE having a unknown version or when there hasn't
been a CPE verified, proposed a search criteria to help the
user research an update.

(libcurl has NIST dict entries but not this version)
  cpe:2.3:a:haxx:libcurl:7.76.1:*:*:*:*:*:*:*
  CPE identifier unknown in CPE database (Search)

(jitterentropy-library package doesn't have any NIST dict entries)
  no verified CPE identifier (Search)

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
---
v2 - new patch
---
 support/scripts/pkg-stats | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/support/scripts/pkg-stats b/support/scripts/pkg-stats
index 6f3ddc561f..bc83ca5888 100755
--- a/support/scripts/pkg-stats
+++ b/support/scripts/pkg-stats
@@ -921,7 +921,13 @@ def dump_html_pkg(f, pkg):
     if pkg.cpeid:
         f.write("  <code>%s</code>\n" % pkg.cpeid)
     if not pkg.is_status_ok("cpe"):
-        f.write("  %s%s\n" % ("<br/>" if pkg.cpeid else "", pkg.status['cpe'][1]))
+        if pkg.cpeid:
+            f.write("  <br/>%s <a href=\"https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=%s\">(Search)</a>\n" % \
+                (pkg.status['cpe'][1], ":".join(pkg.cpeid.split(":")[0:4])))
+        else:
+            f.write("  %s <a href=\"https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=%s\">(Search)</a>\n" % \
+                (pkg.status['cpe'][1], pkg.name))
+
     f.write("  </td>\n")
 
     f.write(" </tr>\n")
-- 
2.17.1

[Buildroot] [PATCH v2 2/2] support/scripts/pkg-stats: add CPE searching links

[Matthew Weber]

On Tue, Apr 20, 2021 at 8:20 PM Matt Weber
<matthew.weber@rockwellcollins.com> wrote:
>
> For cases of a CPE having a unknown version or when there hasn't
> been a CPE verified, proposed a search criteria to help the
> user research an update.
>
> (libcurl has NIST dict entries but not this version)
>   cpe:2.3:a:haxx:libcurl:7.76.1:*:*:*:*:*:*:*
>   CPE identifier unknown in CPE database (Search)
>
> (jitterentropy-library package doesn't have any NIST dict entries)
>   no verified CPE identifier (Search)
>
> Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
> ---
> v2 - new patch
> ---
>  support/scripts/pkg-stats | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/support/scripts/pkg-stats b/support/scripts/pkg-stats
> index 6f3ddc561f..bc83ca5888 100755
> --- a/support/scripts/pkg-stats
> +++ b/support/scripts/pkg-stats
> @@ -921,7 +921,13 @@ def dump_html_pkg(f, pkg):
>      if pkg.cpeid:
>          f.write("  <code>%s</code>\n" % pkg.cpeid)
>      if not pkg.is_status_ok("cpe"):
> -        f.write("  %s%s\n" % ("<br/>" if pkg.cpeid else "", pkg.status['cpe'][1]))
> +        if pkg.cpeid:
> +            f.write("  <br/>%s <a href=\"https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=%s\">(Search)</a>\n" % \
> +                (pkg.status['cpe'][1], ":".join(pkg.cpeid.split(":")[0:4])))

Got a bug. this should be 0:5 not 0:4

Regards,
Matt

[Buildroot] [PATCH v2 1/2] package/libqmi: add _CPE_ID_VENDOR

[Yann E. MORIN]

Matt, All,

On 2021-04-20 20:20 -0500, Matt Weber spake thusly:
> cpe:2.3:a:libqmi_project:libqmi:* is a valid CPE identifier for this package:
> 
>  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3:a:libqmi_project:libqmi
> 
> Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
> v2 - added SOB and moved variable assignment under license files
> ---
>  package/libqmi/libqmi.mk | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/package/libqmi/libqmi.mk b/package/libqmi/libqmi.mk
> index 4b430d11f8..6fc6d4a50d 100644
> --- a/package/libqmi/libqmi.mk
> +++ b/package/libqmi/libqmi.mk
> @@ -9,6 +9,7 @@ LIBQMI_SITE = http://www.freedesktop.org/software/libqmi
>  LIBQMI_SOURCE = libqmi-$(LIBQMI_VERSION).tar.xz
>  LIBQMI_LICENSE = LGPL-2.0+ (library), GPL-2.0+ (programs)
>  LIBQMI_LICENSE_FILES = COPYING COPYING.LIB
> +LIBQMI_CPE_ID_VENDOR = libqmi_project
>  LIBQMI_INSTALL_STAGING = YES
>  
>  LIBQMI_DEPENDENCIES = libglib2
> -- 
> 2.17.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH v2 1/2] package/libqmi: add _CPE_ID_VENDOR

[Peter Korsgaard]

>>>>> "Matt" == Matt Weber <matthew.weber@rockwellcollins.com> writes:

 > cpe:2.3:a:libqmi_project:libqmi:* is a valid CPE identifier for this package:
 >  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3:a:libqmi_project:libqmi

 > Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>

 > ---
 > v2 - added SOB and moved variable assignment under license files

Committed to 2021.02.x, thanks.

-- 
Bye, Peter Korsgaard