Re: [Buildroot] [PATCH 1/3] support/scripts/pkg-stats: remove checking the CPE database

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Wed,  7 Feb 2024 16:35:17 +0100
Arnout Vandecappelle via buildroot <buildroot@buildroot.org> wrote:

> We currently check the CPE database to see if the CPE ID we use
> (including the version) is already in the database.
> 
> However, the version part of the CPE ID is not actually used for CVE
> matching. Instead, the CVEs have a range of versions associated with
> them and we match against those ranges.
> 
> In addition, NVD is moving to a new API for accessing the CPE database.
> It will not longer be possible to simply download all the CPE IDs, and
> due to rate limiting, the download will have to be done in several
> queries.
> 
> Since all of this is anyway of limited use, drop the CPE database lookup
> entirely. Instead, as long as a CPE ID is defined in a package, it is
> considered OK, without any checks.
> 
> Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
> ---
>  support/scripts/pkg-stats | 50 ++-------------------------------------
>  1 file changed, 2 insertions(+), 48 deletions(-)

Series applied, thanks! There were only a few flake8 warnings on PATCH
1/3 due to Python imports that were no longer needed.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot