[Buildroot] [RFC PATCH 03/14] package/pkg-utils: show-info expose vuln details

[Thomas Perale via buildroot <buildroot@buildroot.org>]

For each `_IGNORE_CVES` entries the status and details are exported if
present.

- `<pkg>_<vuln-id>_STATUS`
- `<pkg>_<vuln-id>_DETAIL`

For a hypotetical 'CVE-2025-1234' that affects the package 'foo' with
the following declaration:

```
FOO_CVE-2025-1234_STATUS = fixed
FOO_CVE-2025-1234_DETAIL = some details
```

Will result in the following show info output.

```json
{
    "foo": {
        ...
        "cves_status": {
            "CVE-2025-1234": {
                "status": "fixed",
                "detail": "some details"
            }
        }
    }
}
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/pkg-utils.mk | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/package/pkg-utils.mk b/package/pkg-utils.mk
index 17b0aa1760..c6e509e9d1 100644
--- a/package/pkg-utils.mk
+++ b/package/pkg-utils.mk
@@ -154,6 +154,25 @@ define _json-info-pkg
 				) \
 			)
 		]
+		$(comma) "cves_status": {
+			$(foreach cve,$(sort $($(1)_IGNORE_CVES)), \
+				$(call _json-info-pkg-cve,$(1),$(cve)) \
+			) \
+		}
+	)
+endef
+
+# json-info-pkg-cve -- Create a JSON Object entry of a vulnerability id if the
+#  STATUS & DETAIL variable for that given package name & vulnerability
+#  id combination exists.
+# $(1): upper-case package name
+# $(2): vulnerability id
+define _json-info-pkg-cve
+	$(if $($(1)_$(2)_STATUS),
+		$(call mk-json-str,$(2)): {
+			"status": $(call mk-json-str,$($(1)_$(2)_STATUS))$(comma)
+			"detail": $(call mk-json-str,$($(1)_$(2)_DETAIL))
+		}$(comma)
 	)
 endef
 
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot