[OE-core][PATCH] perl: correct CVE_PRODUCT mapping

[OE-core][PATCH] perl: correct CVE_PRODUCT mapping

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping generates a vendor-wildcard CPE.
perl:perl is the active NVD dictionary CPE and configuration identity and
also covers CNA affected data using vendor perl. larry_wall:perl preserves
historical NVD configurations.

leont:perl covers authoritative CNA affected data for the same Perl/perl5
source, including CVE-2026-15534. It has no dictionary record.

This changes the generated identities to three exact CPEs, but the frozen
sbom-cve-check database leaves the 61-entry CVE report unchanged, with no
current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-devtools/perl/perl_5.44.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/perl/perl_5.44.0.bb b/meta/recipes-devtools/perl/perl_5.44.0.bb
index ef76df7e0f..6cf88e7175 100644
--- a/meta/recipes-devtools/perl/perl_5.44.0.bb
+++ b/meta/recipes-devtools/perl/perl_5.44.0.bb
@@ -25,6 +25,8 @@ SRC_URI:append:class-target = " \
 
 SRC_URI[perl.sha256sum] = "3b855066b92491cb40e86affb1ca57d1a388aa43e51b91c7806a32c2f65f96c3"
 
+CVE_PRODUCT = "perl:perl larry_wall:perl leont:perl"
+
 B = "${WORKDIR}/perl-${PV}-build"
 
 inherit upstream-version-is-even update-alternatives upstream-stable-release-point
-- 
2.35.6