Re: [Buildroot] [PATCH 0/7] Add PURL support

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Thomas Perale <thomas.perale@mind.be>
Cc: Thomas Perale via buildroot <buildroot@buildroot.org>,
	Christian Stewart <christian@aperture.us>,
	Thomas Perale <thomas.perale@essensium.com>
Subject: Re: [Buildroot] [PATCH 0/7] Add PURL support
Date: Fri, 18 Apr 2025 12:39:59 +0200	[thread overview]
Message-ID: <20250418123959.3307e037@windsurf> (raw)
In-Reply-To: <221f0412-b320-4ade-8936-9ae8d941ebf7@mind.be>

Hello,

On Wed, 16 Apr 2025 22:49:15 +0200
Thomas Perale <thomas.perale@mind.be> wrote:

> Just to say that with the PURL added to the Django package I got 
> notified for the CVE.

But with what tool? Right now our "reference" tool to track CVEs in
Buildroot is support/scripts/pkg-stats, which renders:

  http://autobuild.buildroot.net/stats/master.html

And which uses the CVE database from
https://github.com/fkie-cad/nvd-json-data-feeds/.

So I'm still not sure to understand your "DependencyTrack uses NVD
annotation unfortunately". Could you clarify?

Right now, packages have a CPE ID, which we use to match
against https://github.com/fkie-cad/nvd-json-data-feeds/ as part
of the pkg-stats tool. If we want to add more identifiers in packages,
it has to be clear with which CVE database this works, and how this is
going to interact with pkg-stats (and if it doesn't interact, why).

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot