Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Thomas,

On Mon, 21 Apr 2025 22:19:19 +0200
Thomas Perale <thomas.perale@mind.be> wrote:

> > So I'm still not sure to understand your "DependencyTrack uses NVD
> > annotation unfortunately". Could you clarify?  
> 
> The tool is called DependencyTrack (https://dependencytrack.org/), sorry 
> if the name was misleading.

OK.

> It uses the annotation downloaded from NVD to internally do the
> matching with the CPE ID.

Sorry, but I'm not able to parse that. Could you explain?

> Adding PURL definition the SBOM allows DependencyTrack to rely on 
> https://ossindex.sonatype.org/ to match CVE to packages.

OK.

> My series is more about improving the SBOM contents with information 
> that can be consumed by other software rather than improving
> 'pkg-stats' right now. But, it could be used as a fallback for
> packages without a CPE ID manually assigned.

And so DependencyTrack doesn't use CPEs at all? Or uses either CPEs or
PURLs, depending on the CVE?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot