Re: [OE-core][PATCH] u-boot-tools: add CVE_PRODUCT mapping

[Quentin Schulz <quentin.schulz@cherry.de>]

Hi Devansh,

On 8/24/26 1:01 PM, Devansh Patel via lists.openembedded.org wrote:
> From: Devansh Patel <devanshp@cisco.com>
> 
> The current inherited "u-boot-tools" identity has no vulnerability records even
> though this recipe builds host utilities from the U-Boot source tree, so
> source-aligned CVEs are missed.
> 
> Use "u-boot:u-boot" for the CNA affected-data identity and
> "denx:u-boot" for the NVD dictionary CPE and configuration identity.
> 

How about using a file that is included by both u-boot-tools and u-boot 
so that we don't have to not forget to update both?

u-boot-common.inc is included by both u-boot-tools.bb and u-boot.bb so 
that seems like an ideal candidate (if so, then we probably could remove 
CVE_PRODUCT from u-boot.inc?)

We only have denx:u-boot today in u-boot.inc, how did you come to the 
conclusion we also needed u-boot:u-boot?

Cheers,
Quentin