[Buildroot] [PATCH 0/7] Add PURL support

[Buildroot] [PATCH 0/7] Add PURL support

[Thomas Perale via buildroot]

This patch series add support for the PURL.

https://github.com/package-url/purl-spec

PURL are a software identifier similar to CPE.
More information on PURL can be found in the first patch of the series.

After testing the usage of PURL with DependencyTrack and
https://ossindex.sonatype.org I can see that it improves the tracking
of CVEs and version bump. Since it's easy to automate the PURL
generation in buildroot I wrote this patch that I use to add PURL to
CycloneDX SBOM.

The series includes support for PURL for these 'ecosystems':
  - pypi
  - cargo
  - cpan
  - golang

The tracking of CPAN packages is not supported by OSSIndex but these
changes were proposed by François Perrad in the following series:

https://lore.kernel.org/buildroot/20240407144250.7558-1-francois.perrad@gadz.org/

Thomas Perale (7):
  package/pkg-generic.mk: add PURL package variable
  package/pkg-download: add 'owner' macro
  package/pkg-golang: support PURL generation
  package/pkg-cargo: support PURL generation
  package/pkg-perl: support PURL generation
  package/pkg-python: support PURL generation
  package/pkg-utils: add PURL to show-info output

 package/pkg-cargo.mk     |  8 ++++++
 package/pkg-download.mk  |  3 +++
 package/pkg-generic.mk   | 53 ++++++++++++++++++++++++++++++++++++++++
 package/pkg-golang.mk    | 16 ++++++++++++
 package/pkg-perl.mk      | 24 ++++++++++++++++++
 package/pkg-python.mk    | 16 ++++++++++++
 package/pkg-utils.mk     |  3 +++
 utils/generate-cyclonedx |  3 +++
 8 files changed, 126 insertions(+)

-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/7] package/pkg-generic.mk: add PURL package variable

[Thomas Perale via buildroot]

PURL stands for 'package URL', it's a specification that standardize
how packages are identified and located.

PURL is used to reference the same package across different package
manager, tracking tools, API and databases.

A purl is a URL composed of seven components:

  scheme:type/namespace/name@version?qualifiers#subpath

  - scheme: always 'pkg' (required)
  - type: package manager used to install the package, download origin,
      type of package (required)
  - namespace: name prefix, type specific additional information, it can be
      the package author or scope (optional)
  - name: package name (required)
  - version: package version (optional)
  - qualifiers: extra information, could be OS or architecture (optional)
  - subpath: extra subpath relative to package root (optional)

A PURL for the purl-spec repository looks like this:

  pkg:github/package-url/purl-spec@346589846130317464b677bc4eab30bf5040183a

It contains information like the provenance (github), organization
(package-url), name (purl-spec) and version (34658984...).

This patch only introduces a subset of components but can be extended in
the future.

Similarly to the CPE variables, this patch introduces a set of PURL variable:
  - <pkg>_PURL_VALID: Whether the PURL generated for the given <pkg> is
    valid. If set to 'yes' the `<pkg>_PURL` will be defined.
    Similarly to the `<pkg>_CPE_ID_VALID` variable, this will be
    set to 'yes' if one of the following variable is defined.
  - <pkg>_PURL_TYPE: The package type or origin (default to 'generic').
  - <pkg>_PURL_NAMESPACE: The package namespace (optional).
  - <pkg>_PURL_NAME: The package name (default to `<pkg>_RAWNAME`).

If one of those variables is defined the `<pkg>_PURL` variable will be
generated as follows:

  <pkg>_PURL = pkg:$$(<pkg>_PURL_NAMESPACE)/$$(<pkg>_PURL_TYPE)/$$(<pkg>_PURL_NAME)@$$(<pkg>_VERSION)

For more information, see https://github.com/package-url/purl-spec

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-generic.mk | 53 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk
index f22b6e981a..1e68f48f7c 100644
--- a/package/pkg-generic.mk
+++ b/package/pkg-generic.mk
@@ -745,6 +745,59 @@ ifeq ($$($(2)_CPE_ID_VALID),YES)
  $(2)_CPE_ID = $$($(2)_CPE_ID_PREFIX):$$($(2)_CPE_ID_VENDOR):$$($(2)_CPE_ID_PRODUCT):$$($(2)_CPE_ID_VERSION):$$($(2)_CPE_ID_UPDATE):*:*:*:*:*:*
 endif # ifeq ($$($(2)_CPE_ID_VALID),YES)
 
+# If any of the <pkg>_PURL_* variables are set, we assume the PURL
+# information is valid for this package.
+ifneq ($$($(2)_PURL_TYPE)$$($(2)_PURL_NAME)$$($(2)_PURL_NAMESPACE),)
+$(2)_PURL_VALID = YES
+endif
+
+# When we're a host package, make sure to use the variables of the
+# corresponding target package, if any.
+ifneq ($$($(3)_PURL_TYPE)$$($(3)_PURL_NAME)$$($(3)_PURL_NAMESPACE),)
+$(2)_PURL_VALID = YES
+endif
+
+# If the PURL is valid for the target package so it is for the host
+# package
+ifndef $(2)_PURL_VALID
+ ifdef $(3)_PURL_VALID
+   $(2)_PURL_VALID = $$($(3)_PURL_VALID)
+ endif
+endif
+
+ifeq ($$($(2)_PURL_VALID),YES)
+  # The package PURL type or provider.
+  # ex. pypi, npm, gem, ...
+  ifndef $(2)_PURL_TYPE
+   ifdef $(3)_PURL_TYPE
+    $(2)_PURL_TYPE = $$($(3)_PURL_TYPE)
+   else
+    $(2)_PURL_TYPE = generic
+   endif
+  endif
+
+  # The package PURL optional namespace
+  ifndef $(2)_PURL_NAMESPACE
+   ifdef $(3)_PURL_NAMESPACE
+    $(2)_PURL_NAMESPACE = $$($(3)_PURL_NAMESPACE)
+   endif
+  endif
+
+  # The package PURL name
+  # default to $(2)_RAWNAME
+  ifndef $(2)_PURL_NAME
+   ifdef $(3)_PURL_NAME
+    $(2)_PURL_NAME = $$($(3)_PURL_NAME)
+   else
+    $(2)_PURL_NAME = $$($(2)_RAWNAME)
+   endif
+  endif
+
+  # A PURL is created based on the $(2)_PURL_* variable values.
+  # see https://github.com/package-url/purl-spec
+  $(2)_PURL = pkg:$$($(2)_PURL_TYPE)/$$(if $$($(2)_PURL_NAMESPACE),$$($(2)_PURL_NAMESPACE)/)$$($(2)_PURL_NAME)$$(if $$($(2)_VERSION),@$$($(2)_VERSION))
+endif # ifeq ($$($(2)_PURL_VALID),YES)
+
 # When a target package is a toolchain dependency set this variable to
 # 'NO' so the 'toolchain' dependency is not added to prevent a circular
 # dependency.
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/7] package/pkg-download: add 'owner' macro

[Thomas Perale via buildroot]

This patch introduces the 'owner' macro that retrieve the repository
owner part of an URL.

This macro works for repositories that share the URL scheme of website
such as Github or Gitlab:

```
https://{github|gitlab}.com/<owner>/<name>/....
```

The macro will retrieve the 'owner' part of
the url.

For example with the 'mender' package version '3.5.3'. The `MENDER_SITE`
variable value is the following.

```
MENDER_SITE=https://github.com/mendersoftware/mender/archive/3.5.3
```

Calling the 'owner' macro will retrieve the following.

```
$(call owner,$(MENDER_SITE)) # mendersoftware
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-download.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/pkg-download.mk b/package/pkg-download.mk
index cf5959ea95..3c946a3f69 100644
--- a/package/pkg-download.mk
+++ b/package/pkg-download.mk
@@ -49,6 +49,9 @@ notdomain = $(patsubst $(call domain,$(1),$(2))$(call domainseparator,$(2))%,%,$
 #
 # default domainseparator is /, specify alternative value as first argument
 domainseparator = $(if $(1),$(1),/)
+# Retrieve the repository owner from an url
+# owner: {github,gitlab}.com/<owner>/...
+owner = $(firstword $(subst /, ,$(call notdomain,$(1))))
 
 # github(user,package,version): returns site of GitHub repository
 github = https://github.com/$(1)/$(2)/archive/$(3)
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/7] package/pkg-download: add repository macro

[Thomas Perale via buildroot]

This patch introduces the 'repository' macro that retrieve the repository
part of an URL.

This macro works for repositories that share the URL scheme of website
such as Github or Gitlab:

```
https://{github|gitlab}.com/<owner>/<name>
```

The macro will retrieve the '{github|gitlab}.com/<owner>/<name>' part of
the url.
This macro will works as well for the `<pkg>_SITE` variable made with
the `github` & `gitlab` macros.

For example with the 'mender' package version '3.5.3'. The `MENDER_SITE`
variable value is the following.

```
MENDER_SITE=https://github.com/mendersoftware/mender/archive/3.5.3
```

Calling the 'repository' macro will retrieve the following.

```
$(call repository,$(MENDER_SITE)) # github.com/mendersoftware/mender
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-download.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/pkg-download.mk b/package/pkg-download.mk
index cf5959ea95..4a2561cf86 100644
--- a/package/pkg-download.mk
+++ b/package/pkg-download.mk
@@ -49,6 +49,9 @@ notdomain = $(patsubst $(call domain,$(1),$(2))$(call domainseparator,$(2))%,%,$
 #
 # default domainseparator is /, specify alternative value as first argument
 domainseparator = $(if $(1),$(1),/)
+# Retrieve the repository from an url
+# repository: {github,gitlab}.com/<owner>/<name>
+repository = $(call domain,$(1))/$(word 1,$(subst /, ,$(call notdomain,$(1))))/$(word 2,$(subst /, ,$(call notdomain,$(1))))
 
 # github(user,package,version): returns site of GitHub repository
 github = https://github.com/$(1)/$(2)/archive/$(3)
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 3/7] package/pkg-golang: support PURL generation

[Thomas Perale via buildroot]

The PURL specification for Golang packages follows the coordinates from
the sonatype ossindex:

https://ossindex.sonatype.org/ecosystem/golang

- The PURL type is defined as 'golang'.
- The PURL namespace of the packages is made of the source host website,
  the owner.
- The PURL name is the package name.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-golang.mk | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
index a4e8bd30cc..f76c976ce3 100644
--- a/package/pkg-golang.mk
+++ b/package/pkg-golang.mk
@@ -182,6 +182,22 @@ define $(2)_INSTALL_CMDS
 endef
 endif
 
+ifndef $(2)_PURL_TYPE
+ ifdef $(3)_PURL_TYPE
+  $(2)_PURL_TYPE = $$($(3)_PURL_TYPE)
+ else
+  $(2)_PURL_TYPE = golang
+ endif
+endif
+
+ifndef $(2)_PURL_NAMESPACE
+ ifdef $(3)_PURL_NAMESPACE
+  $(2)_PURL_NAMESPACE = $$($(3)_PURL_NAMESPACE)
+ else
+  $(2)_PURL_NAMESPACE = $$(call domain,$$($(2)_SITE))/$$(call owner,$$($(2)_SITE))
+ endif
+endif
+
 # Call the generic package infrastructure to generate the necessary make
 # targets
 $(call inner-generic-package,$(1),$(2),$(3),$(4))
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 4/7] package/pkg-cargo: support PURL generation

[Thomas Perale via buildroot]

The PURL specification for Cargo packages follows the coordinates from
the sonatype ossindex:

https://ossindex.sonatype.org/ecosystem/cargo

- The type is defined as 'cargo'.
- The name is the package name

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-cargo.mk | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package/pkg-cargo.mk b/package/pkg-cargo.mk
index 47a6353f25..6fb3cb8bc2 100644
--- a/package/pkg-cargo.mk
+++ b/package/pkg-cargo.mk
@@ -306,6 +306,14 @@ define $(2)_INSTALL_CMDS
 endef
 endif
 
+ifndef $(2)_PURL_TYPE
+ ifdef $(3)_PURL_TYPE
+  $(2)_PURL_TYPE = $$($(3)_PURL_TYPE)
+ else
+  $(2)_PURL_TYPE = cargo
+ endif
+endif
+
 # Call the generic package infrastructure to generate the necessary
 # make targets
 $(call inner-generic-package,$(1),$(2),$(3),$(4))
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 5/7] package/pkg-perl: support PURL generation

[Thomas Perale via buildroot]

The PURL specification for CPAN packages follows the coordinates from
the following:

https://github.com/giterlizzi/perl-URI-PackageURL

 - The PURL type is defined as 'cpan'.
 - The PURL namespace is the author of the package.
 - The PURL name is '<pkg>_DISTNAME' variable

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-perl.mk | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/package/pkg-perl.mk b/package/pkg-perl.mk
index 1ecf31eff9..1e10d21274 100644
--- a/package/pkg-perl.mk
+++ b/package/pkg-perl.mk
@@ -193,6 +193,30 @@ define $(2)_INSTALL_TARGET_CMDS
 endef
 endif
 
+ifndef $(2)_PURL_TYPE
+ ifdef $(3)_PURL_TYPE
+  $(2)_PURL_TYPE = $$($(3)_PURL_TYPE)
+ else
+  $(2)_PURL_TYPE = cpan
+ endif
+endif
+
+ifndef $(2)_PURL_NAMESPACE
+ ifdef $(3)_PURL_NAMESPACE
+  $(2)_PURL_NAMESPACE = $$($(3)_PURL_NAMESPACE)
+ else
+  $(2)_PURL_NAMESPACE = $(notdir $($(3)_SITE))
+ endif
+endif
+
+ifndef $(2)_PURL_NAME
+ ifdef $(3)_PURL_NAME
+  $(2)_PURL_NAME = $$($(3)_PURL_NAME)
+ else
+  $(2)_PURL_NAME = $$($$(3)_DISTNAME)
+ endif
+endif
+
 # Call the generic package infrastructure to generate the necessary
 # make targets
 $(call inner-generic-package,$(1),$(2),$(3),$(4))
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 6/7] package/pkg-python: support PURL generation

[Thomas Perale via buildroot]

The PURL specification for python packages follows the coordinates from
the sonatype ossindex:

https://ossindex.sonatype.org/ecosystem/pypi

- The PURL type is 'pypi'.
- The PURL name is the package name. Since buildroot python packages
  include a 'python-' prefix to the name of package, this part is
  stripped.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-python.mk | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/package/pkg-python.mk b/package/pkg-python.mk
index 32ace4aac1..c125b2e009 100644
--- a/package/pkg-python.mk
+++ b/package/pkg-python.mk
@@ -454,6 +454,22 @@ endif
 
 endif # host / target
 
+ifndef $(2)_PURL_TYPE
+ ifdef $(3)_PURL_TYPE
+  $(2)_PURL_TYPE = $$($(3)_PURL_TYPE)
+ else
+  $(2)_PURL_TYPE = pypi
+ endif
+endif
+
+ifndef $(2)_PURL_NAME
+ ifdef $(3)_PURL_NAME
+  $(2)_PURL_NAME = $$($(3)_PURL_NAME)
+ else
+  $(2)_PURL_NAME=$$(patsubst python-%,%,$$($(2)_RAWNAME))
+ endif
+endif
+
 # Call the generic package infrastructure to generate the necessary
 # make targets
 $(call inner-generic-package,$(1),$(2),$(3),$(4))
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 7/7] package/pkg-utils: add PURL to show-info output

[Thomas Perale via buildroot]

This patch add a "purl" entry to packages that have an associated valid
PURL.

This patch update the `generate-cyclonedx` script as well to reflect the
change in the `show-info` output.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-utils.mk     | 3 +++
 utils/generate-cyclonedx | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/package/pkg-utils.mk b/package/pkg-utils.mk
index 0266f66b42..5fdd9dcfe1 100644
--- a/package/pkg-utils.mk
+++ b/package/pkg-utils.mk
@@ -145,6 +145,9 @@ define _json-info-pkg
 	$(if $($(1)_CPE_ID_VALID), \
 		$(comma) "cpe-id": $(call mk-json-str,$($(1)_CPE_ID)) \
 	)
+	$(if $($(1)_PURL), \
+		$(comma) "purl": $(call mk-json-str,$($(1)_PURL)) \
+	)
 	$(if $($(1)_IGNORE_CVES),
 		$(comma) "ignore_cves": [
 			$(call make-comma-list, \
diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index 46f68ac63d..f5f80c59d3 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -185,6 +185,9 @@ def cyclonedx_component(name, comp):
         **({
             "cpe": comp["cpe-id"],
         } if "cpe-id" in comp else {}),
+        **({
+            "purl": comp["purl"],
+        } if "purl" in comp else {}),
         **(cyclonedx_patches(comp["patches"]) if comp.get("patches") else {}),
         "properties": [{
             "name": "BR_TYPE",
-- 
2.49.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Perale via buildroot <buildroot@buildroot.org> writes:

 > This patch series add support for the PURL.
 > https://github.com/package-url/purl-spec

Nice!

 > PURL are a software identifier similar to CPE.
 > More information on PURL can be found in the first patch of the series.

 > After testing the usage of PURL with DependencyTrack and
 > https://ossindex.sonatype.org I can see that it improves the tracking
 > of CVEs and version bump

Out of interest, how does it help (do you have an example?)

Does a PURL match complicate anything if we add a local (security) patch
to a package?

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Arnout Vandecappelle via buildroot]

On 16/04/2025 21:07, Peter Korsgaard wrote:
>>>>>> "Thomas" == Thomas Perale via buildroot <buildroot@buildroot.org> writes:
>   > This patch series add support for the PURL.
>   > https://github.com/package-url/purl-spec
>
> Nice!
>
>   > PURL are a software identifier similar to CPE.
>   > More information on PURL can be found in the first patch of the series.
>
>   > After testing the usage of PURL with DependencyTrack and
>   > https://ossindex.sonatype.org I can see that it improves the tracking
>   > of CVEs and version bump
>
> Out of interest, how does it help (do you have an example?)
>
> Does a PURL match complicate anything if we add a local (security) patch
> to a package?

  As long as the tool reports CVEs, the CVE exclusions still work. (Well, I 
don't actually know for sure if the CVE exclusions really work in 
DependencyTrack with our CycloneDX, IIUC it's complicated :-).

  Of course, if the tool reports GHSA's, there's nothing we can do with that...


  Regards,
  Arnout

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Petazzoni via buildroot]

Hello Thomas,

On Wed, 16 Apr 2025 21:50:48 +0200
Thomas Perale <thomas.perale@essensium.com> wrote:

> The second advantage I see is that OSSIndex (that works with PURL) seems 
> to have a better matching of the CVE with packages. For instance 
> https://nvd.nist.gov/vuln/detail/CVE-2025-27556 is not reported for the 
> Django package and not associated to any version.

That's because it has not been annotated by NVD. However
https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/27xxx/CVE-2025-27556.json
does have it annotated, and associated to
"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*".

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Perale via buildroot]

Hello Thomas,

DependencyTrack uses NVD annotation unfortunately.

Regards,
Thomas

On 4/16/25 9:58 PM, Thomas Petazzoni wrote:
> Hello Thomas,
>
> On Wed, 16 Apr 2025 21:50:48 +0200
> Thomas Perale <thomas.perale@essensium.com> wrote:
>
>> The second advantage I see is that OSSIndex (that works with PURL) seems
>> to have a better matching of the CVE with packages. For instance
>> https://nvd.nist.gov/vuln/detail/CVE-2025-27556 is not reported for the
>> Django package and not associated to any version.
> That's because it has not been annotated by NVD. However
> https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/27xxx/CVE-2025-27556.json
> does have it annotated, and associated to
> "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*".
>
> Best regards,
>
> Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Petazzoni via buildroot]

Hello,

On Wed, 16 Apr 2025 22:06:17 +0200
Thomas Perale <thomas.perale@mind.be> wrote:

> DependencyTrack uses NVD annotation unfortunately.

And? Sorry, I'm not sure to follow you.

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Perale via buildroot]

Just to say that with the PURL added to the Django package I got 
notified for the CVE.

On 4/16/25 10:40 PM, Thomas Petazzoni wrote:
> Hello,
>
> On Wed, 16 Apr 2025 22:06:17 +0200
> Thomas Perale <thomas.perale@mind.be> wrote:
>
>> DependencyTrack uses NVD annotation unfortunately.
> And? Sorry, I'm not sure to follow you.
>
> Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Petazzoni via buildroot]

Hello,

On Wed, 16 Apr 2025 22:49:15 +0200
Thomas Perale <thomas.perale@mind.be> wrote:

> Just to say that with the PURL added to the Django package I got 
> notified for the CVE.

But with what tool? Right now our "reference" tool to track CVEs in
Buildroot is support/scripts/pkg-stats, which renders:

  http://autobuild.buildroot.net/stats/master.html

And which uses the CVE database from
https://github.com/fkie-cad/nvd-json-data-feeds/.

So I'm still not sure to understand your "DependencyTrack uses NVD
annotation unfortunately". Could you clarify?

Right now, packages have a CPE ID, which we use to match
against https://github.com/fkie-cad/nvd-json-data-feeds/ as part
of the pkg-stats tool. If we want to add more identifiers in packages,
it has to be clear with which CVE database this works, and how this is
going to interact with pkg-stats (and if it doesn't interact, why).

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Perale via buildroot]

Hi Thomas,

> But with what tool?

> So I'm still not sure to understand your "DependencyTrack uses NVD
> annotation unfortunately". Could you clarify?

The tool is called DependencyTrack (https://dependencytrack.org/), sorry 
if the name was misleading. It uses the annotation downloaded from NVD 
to internally do the matching with the CPE ID.

Adding PURL definition the SBOM allows DependencyTrack to rely on 
https://ossindex.sonatype.org/ to match CVE to packages.

> it has to be clear with which CVE database this works, and how this is
> going to interact with pkg-stats (and if it doesn't interact, why).
My series is more about improving the SBOM contents with information 
that can be consumed by other software rather than improving 'pkg-stats' 
right now. But, it could be used as a fallback for packages without a 
CPE ID manually assigned.

Regards
Thomas

On 4/18/25 12:39 PM, Thomas Petazzoni wrote:
> Hello,
>
> On Wed, 16 Apr 2025 22:49:15 +0200
> Thomas Perale <thomas.perale@mind.be> wrote:
>
>> Just to say that with the PURL added to the Django package I got
>> notified for the CVE.
> But with what tool? Right now our "reference" tool to track CVEs in
> Buildroot is support/scripts/pkg-stats, which renders:
>
>    http://autobuild.buildroot.net/stats/master.html
>
> And which uses the CVE database from
> https://github.com/fkie-cad/nvd-json-data-feeds/.
>
> So I'm still not sure to understand your "DependencyTrack uses NVD
> annotation unfortunately". Could you clarify?
>
> Right now, packages have a CPE ID, which we use to match
> against https://github.com/fkie-cad/nvd-json-data-feeds/ as part
> of the pkg-stats tool. If we want to add more identifiers in packages,
> it has to be clear with which CVE database this works, and how this is
> going to interact with pkg-stats (and if it doesn't interact, why).
>
> Best regards,
>
> Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Thomas Petazzoni via buildroot]

Hello Thomas,

On Mon, 21 Apr 2025 22:19:19 +0200
Thomas Perale <thomas.perale@mind.be> wrote:

> > So I'm still not sure to understand your "DependencyTrack uses NVD
> > annotation unfortunately". Could you clarify?  
> 
> The tool is called DependencyTrack (https://dependencytrack.org/), sorry 
> if the name was misleading.

OK.

> It uses the annotation downloaded from NVD to internally do the
> matching with the CPE ID.

Sorry, but I'm not able to parse that. Could you explain?

> Adding PURL definition the SBOM allows DependencyTrack to rely on 
> https://ossindex.sonatype.org/ to match CVE to packages.

OK.

> My series is more about improving the SBOM contents with information 
> that can be consumed by other software rather than improving
> 'pkg-stats' right now. But, it could be used as a fallback for
> packages without a CPE ID manually assigned.

And so DependencyTrack doesn't use CPEs at all? Or uses either CPEs or
PURLs, depending on the CVE?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 0/7] Add PURL support

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Petazzoni <thomas.petazzoni@bootlin.com> writes:

Hi,

 >> My series is more about improving the SBOM contents with information 
 >> that can be consumed by other software rather than improving
 >> 'pkg-stats' right now. But, it could be used as a fallback for
 >> packages without a CPE ID manually assigned.

 > And so DependencyTrack doesn't use CPEs at all? Or uses either CPEs or
 > PURLs, depending on the CVE?

If I get it correctly, dependencytrack has multiple vulnerability
sources, which do their lookups based on CPE OR PURL depending on the
source:

https://docs.dependencytrack.org/analysis-types/known-vulnerabilities/

It is not really clear to me how the github advisories are matched
against the components? I would think that those are more interesting
(E.G. applying more widely) than the subset of PURLs supported by
sonatype.

The documentation doesn't really say much:
https://docs.dependencytrack.org/datasources/github-advisories/

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot