Re: [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Sat, 26 Apr 2025 09:33:05 +0200
Thomas Perale via buildroot <buildroot@buildroot.org> wrote:

> Since commit [1], the host-nodejs package was turned into a virtual
> package. However, the target nodejs package was intentionally not
> turned into a virtual package and became an empty package.
> The reason for this is:
> 
>   - No alternatives providers were introduced for the target nodejs
>     package.
>   - The Config.in remained unchaged for the target package.
> 
> As a result, running `make show-info` with a config that includes the
> target nodejs package, outputs an entry for the empty package:
> 
> ```
> "nodejs": {
>     "type": "target",
>     "name": "nodejs",
>     "virtual": false,
>     "version": "",
>     ...
>     "cpe-id": "cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*"
> },
> ```
> 
> This can be an issue because the CPE ID of the empty nodejs package
> is the following `cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*`.
> Reporting such a CPE ID can be an issue for certain software that consume
> the SBOM and could be interpreted as CPE that matches with every versions
> of the package.
> 
> This patch converts the target nodejs package into a virtual package to
> prevents the empty package from being included in the SBOM.
> 
> [1] 4cbc2af604 package/nodejs: rename to nodejs-src and convert to virtual package
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>  package/nodejs/Config.in                | 4 ++++
>  package/nodejs/nodejs-src/nodejs-src.mk | 1 +
>  package/nodejs/nodejs.mk                | 3 +--
>  3 files changed, 6 insertions(+), 2 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot