* Re: [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual
2025-04-26 7:33 [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual Thomas Perale via buildroot
@ 2025-05-13 9:07 ` Johan Derycke
2025-05-17 9:38 ` Thomas Petazzoni via buildroot
2025-05-18 14:45 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Johan Derycke @ 2025-05-13 9:07 UTC (permalink / raw)
To: Thomas Perale; +Cc: buildroot, Daniel Price, Thomas Petazzoni, Martin Bark
[-- Attachment #1.1: Type: text/plain, Size: 3277 bytes --]
Hi,
Tested on 2024.02 branch. Makes "Dependency-Track" happy :-)
Tested-by: johan.derycke@barco.com
Op za 26 apr 2025 om 09:34 schreef Thomas Perale via buildroot <
buildroot@buildroot.org>:
> Since commit [1], the host-nodejs package was turned into a virtual
> package. However, the target nodejs package was intentionally not
> turned into a virtual package and became an empty package.
> The reason for this is:
>
> - No alternatives providers were introduced for the target nodejs
> package.
> - The Config.in remained unchaged for the target package.
>
> As a result, running `make show-info` with a config that includes the
> target nodejs package, outputs an entry for the empty package:
>
> ```
> "nodejs": {
> "type": "target",
> "name": "nodejs",
> "virtual": false,
> "version": "",
> ...
> "cpe-id": "cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*"
> },
> ```
>
> This can be an issue because the CPE ID of the empty nodejs package
> is the following `cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*`.
> Reporting such a CPE ID can be an issue for certain software that consume
> the SBOM and could be interpreted as CPE that matches with every versions
> of the package.
>
> This patch converts the target nodejs package into a virtual package to
> prevents the empty package from being included in the SBOM.
>
> [1] 4cbc2af604 package/nodejs: rename to nodejs-src and convert to virtual
> package
>
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
> package/nodejs/Config.in | 4 ++++
> package/nodejs/nodejs-src/nodejs-src.mk | 1 +
> package/nodejs/nodejs.mk | 3 +--
> 3 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/package/nodejs/Config.in b/package/nodejs/Config.in
> index 50d1360715..2a0074b5a4 100644
> --- a/package/nodejs/Config.in
> +++ b/package/nodejs/Config.in
> @@ -87,4 +87,8 @@ config BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL_DEPS
>
> endif
>
> +config BR2_PACKAGE_PROVIDES_NODEJS
> + string
> + default "nodejs-src"
> +
> source "package/nodejs/nodejs-src/Config.in"
> diff --git a/package/nodejs/nodejs-src/nodejs-src.mk
> b/package/nodejs/nodejs-src/nodejs-src.mk
> index 8f934202b0..30e72743a1 100644
> --- a/package/nodejs/nodejs-src/nodejs-src.mk
> +++ b/package/nodejs/nodejs-src/nodejs-src.mk
> @@ -14,6 +14,7 @@ NODEJS_SRC_LICENSE_FILES = $(NODEJS_LICENSE_FILES)
> NODEJS_SRC_CPE_ID_VENDOR = $(NODEJS_CPE_ID_VENDOR)
> NODEJS_SRC_CPE_ID_PRODUCT = $(NODEJS_CPE_ID_PRODUCT)
>
> +NODEJS_SRC_PROVIDES = nodejs
> HOST_NODEJS_SRC_PROVIDES = host-nodejs
>
> NODEJS_SRC_DEPENDENCIES = \
> diff --git a/package/nodejs/nodejs.mk b/package/nodejs/nodejs.mk
> index 6dc0e501b4..752971c4a6 100644
> --- a/package/nodejs/nodejs.mk
> +++ b/package/nodejs/nodejs.mk
> @@ -32,8 +32,7 @@ PNPM = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/pnpm
> YARN = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/yarn
> endif
>
> -NODEJS_DEPENDENCIES = nodejs-src
> -$(eval $(generic-package))
> +$(eval $(virtual-package))
> $(eval $(host-virtual-package))
>
> include $(sort $(wildcard package/nodejs/*/*.mk))
> --
> 2.49.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
>
[-- Attachment #1.2: Type: text/html, Size: 5013 bytes --]
[-- Attachment #2: Type: text/plain, Size: 150 bytes --]
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual
2025-04-26 7:33 [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual Thomas Perale via buildroot
2025-05-13 9:07 ` Johan Derycke
@ 2025-05-17 9:38 ` Thomas Petazzoni via buildroot
2025-05-18 14:45 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Petazzoni via buildroot @ 2025-05-17 9:38 UTC (permalink / raw)
To: Thomas Perale via buildroot; +Cc: Thomas Perale, Daniel Price, Martin Bark
On Sat, 26 Apr 2025 09:33:05 +0200
Thomas Perale via buildroot <buildroot@buildroot.org> wrote:
> Since commit [1], the host-nodejs package was turned into a virtual
> package. However, the target nodejs package was intentionally not
> turned into a virtual package and became an empty package.
> The reason for this is:
>
> - No alternatives providers were introduced for the target nodejs
> package.
> - The Config.in remained unchaged for the target package.
>
> As a result, running `make show-info` with a config that includes the
> target nodejs package, outputs an entry for the empty package:
>
> ```
> "nodejs": {
> "type": "target",
> "name": "nodejs",
> "virtual": false,
> "version": "",
> ...
> "cpe-id": "cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*"
> },
> ```
>
> This can be an issue because the CPE ID of the empty nodejs package
> is the following `cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*`.
> Reporting such a CPE ID can be an issue for certain software that consume
> the SBOM and could be interpreted as CPE that matches with every versions
> of the package.
>
> This patch converts the target nodejs package into a virtual package to
> prevents the empty package from being included in the SBOM.
>
> [1] 4cbc2af604 package/nodejs: rename to nodejs-src and convert to virtual package
>
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
> package/nodejs/Config.in | 4 ++++
> package/nodejs/nodejs-src/nodejs-src.mk | 1 +
> package/nodejs/nodejs.mk | 3 +--
> 3 files changed, 6 insertions(+), 2 deletions(-)
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual
2025-04-26 7:33 [Buildroot] [PATCH 1/1] package/nodejs: make target nodejs package virtual Thomas Perale via buildroot
2025-05-13 9:07 ` Johan Derycke
2025-05-17 9:38 ` Thomas Petazzoni via buildroot
@ 2025-05-18 14:45 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Arnout Vandecappelle via buildroot @ 2025-05-18 14:45 UTC (permalink / raw)
To: Thomas Perale, buildroot; +Cc: Daniel Price, Martin Bark, Thomas Petazzoni
On 26/04/2025 09:33, Thomas Perale wrote:
> Since commit [1], the host-nodejs package was turned into a virtual
> package. However, the target nodejs package was intentionally not
> turned into a virtual package and became an empty package.
> The reason for this is:
>
> - No alternatives providers were introduced for the target nodejs
> package.
> - The Config.in remained unchaged for the target package.
>
> As a result, running `make show-info` with a config that includes the
> target nodejs package, outputs an entry for the empty package:
>
> ```
> "nodejs": {
> "type": "target",
> "name": "nodejs",
> "virtual": false,
> "version": "",
> ...
> "cpe-id": "cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*"
> },
> ```
>
> This can be an issue because the CPE ID of the empty nodejs package
> is the following `cpe:2.3:a:nodejs:node.js::*:*:*:*:*:*:*`.
> Reporting such a CPE ID can be an issue for certain software that consume
> the SBOM and could be interpreted as CPE that matches with every versions
> of the package.
>
> This patch converts the target nodejs package into a virtual package to
> prevents the empty package from being included in the SBOM.
>
> [1] 4cbc2af604 package/nodejs: rename to nodejs-src and convert to virtual package
>
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Applied to 2025.02.x, thanks.
Regards,
Arnout
> ---
> package/nodejs/Config.in | 4 ++++
> package/nodejs/nodejs-src/nodejs-src.mk | 1 +
> package/nodejs/nodejs.mk | 3 +--
> 3 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/package/nodejs/Config.in b/package/nodejs/Config.in
> index 50d1360715..2a0074b5a4 100644
> --- a/package/nodejs/Config.in
> +++ b/package/nodejs/Config.in
> @@ -87,4 +87,8 @@ config BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL_DEPS
>
> endif
>
> +config BR2_PACKAGE_PROVIDES_NODEJS
> + string
> + default "nodejs-src"
> +
> source "package/nodejs/nodejs-src/Config.in"
> diff --git a/package/nodejs/nodejs-src/nodejs-src.mk b/package/nodejs/nodejs-src/nodejs-src.mk
> index 8f934202b0..30e72743a1 100644
> --- a/package/nodejs/nodejs-src/nodejs-src.mk
> +++ b/package/nodejs/nodejs-src/nodejs-src.mk
> @@ -14,6 +14,7 @@ NODEJS_SRC_LICENSE_FILES = $(NODEJS_LICENSE_FILES)
> NODEJS_SRC_CPE_ID_VENDOR = $(NODEJS_CPE_ID_VENDOR)
> NODEJS_SRC_CPE_ID_PRODUCT = $(NODEJS_CPE_ID_PRODUCT)
>
> +NODEJS_SRC_PROVIDES = nodejs
> HOST_NODEJS_SRC_PROVIDES = host-nodejs
>
> NODEJS_SRC_DEPENDENCIES = \
> diff --git a/package/nodejs/nodejs.mk b/package/nodejs/nodejs.mk
> index 6dc0e501b4..752971c4a6 100644
> --- a/package/nodejs/nodejs.mk
> +++ b/package/nodejs/nodejs.mk
> @@ -32,8 +32,7 @@ PNPM = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/pnpm
> YARN = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/yarn
> endif
>
> -NODEJS_DEPENDENCIES = nodejs-src
> -$(eval $(generic-package))
> +$(eval $(virtual-package))
> $(eval $(host-virtual-package))
>
> include $(sort $(wildcard package/nodejs/*/*.mk))
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread