Re: [Buildroot] [PATCH 2/2] package/openjdk: CPE ID for openjdk

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Bjørn,

On Sat, Oct 03, 2026 at 07:36:57PM +0200, Bjørn Damstedt Rasmussen wrote:
> The CPE ID on version 21.0.2 in NVD:
> https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oracle:openjdk:21.0.2:*:*:*:*:*:*:*
> 
> The automatically generated OPENJDK_CPE_ID_VERSION cannot be used
> because OPENJDK_VERSION includes a '+', e.g. "21.0.2+10". NVD will not
> accept a version number with '+'.
> 
> Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
> ---
>  package/openjdk/openjdk.mk | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/package/openjdk/openjdk.mk b/package/openjdk/openjdk.mk
> index fbc860019c..95efe2ba19 100644
> --- a/package/openjdk/openjdk.mk
> +++ b/package/openjdk/openjdk.mk
> @@ -17,6 +17,13 @@ OPENJDK_VERSION_MAJOR = 17
>  OPENJDK_VERSION_MINOR = 0.18
>  OPENJDK_VERSION_BUILD = 8
>  endif
> +
> +OPENJDK_CPE_ID_VENDOR = oracle
> +OPENJDK_CPE_ID_VALID = YES
> +
> +# Override automatic CPE ID because '+' in $(OPENJDK_VERSION) is not alphanumeric or ._-
> +OPENJDK_CPE_ID_VERSION = $(OPENJDK_VERSION_MAJOR).$(OPENJDK_VERSION_MINOR)
> +
>  OPENJDK_VERSION = $(OPENJDK_VERSION_MAJOR).$(OPENJDK_VERSION_MINOR)+$(OPENJDK_VERSION_BUILD)
>  OPENJDK_SITE = $(call github,openjdk,jdk$(OPENJDK_VERSION_MAJOR)u,jdk-$(OPENJDK_VERSION))

Thanks for the v2! However this was causing some check-package
warnings, for valid reasons:

WARNING: package/openjdk/openjdk.mk:25: expecting package version to be set before CPE_ID_VERSION
WARNING: package/openjdk/openjdk.mk:22: 'YES' is implied when a non-default CPE_ID field is specified: OPENJDK_CPE_ID_VALID = YES (https://nightly.buildroot.org/#cpe-id)

<pkg>_CPE_ID_VALID = YES is only useful when no other CPE_ID_*
variable is set. As soon as you set CPE_ID_VENDOR, CPE_ID_PRODUCT,
CPE_ID_VERSION, etc. we assume that someone has checked the CPE
identifier, and therefore we assume that the CPE identifier is valid
(and we set CPE_ID_VALID = YES). Therefore, setting CPE_ID_VALID = YES
is redundant in your patch.

For the CPE_ID_VERSION calculation, for consistency we like to see it
defined after the package version.

I fixed that up when applying. Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot