On Fri, Sep 11, 2026 at 01:37 PM, Yoann Congal wrote: > > On Wed Sep 2, 2026 at 8:09 AM CEST, Darsh Kelaiya -X (dkelaiya - E > INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > >> From: Devansh Patel <[email protected]> >> >> The product-only "py" mapping generates a wildcard-vendor identity >> instead of the exact NVD identity for the packaged pytest-dev py >> source. Use "pytest:py" for its NVD dictionary CPE and configuration >> matches. >> >> This changes the generated product identity. With sbom-cve-check 1.3.3, >> the current CVE report is unchanged using the pinned database snapshots; >> both mappings report CVE-2020-29651 and CVE-2022-42969. >> >> Signed-off-by: Devansh Patel <[email protected]> >> Signed-off-by: Khem Raj <[email protected]> >> (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f) >> Signed-off-by: Darsh Kelaiya <[email protected]> >> --- >> meta/recipes-devtools/python/python3-py_1.11.0.bb | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb >> b/meta/recipes-devtools/python/python3-py_1.11.0.bb >> index a75b9c2b14..906410e9bb 100644 >> --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb >> +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb >> @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = >> "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" >> >> SRC_URI[sha256sum] = >> "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" >> >> -CVE_PRODUCT = "py" >> +CVE_PRODUCT = "pytest:py" >> >> DEPENDS += "python3-setuptools-scm-native" > > Hello, > > As far as I can tell, this is also needed on meta-oe/wrynose. Can you > send a backport there, please? > > Since patches 2&3/3 conflicts, I'll hold both until "python3-py: correct > CVE_PRODUCT mapping" lands on meta-oe/wrynose. > > Baring future issues, I'll take 1/3. > > Thanks! > -- > Yoann Congal > Smile ECS
Hello Yoann, Thanks for highlighting this. I've sent the requested "python3-py: correct CVE_PRODUCT mapping" as shown here for Wrynose: https://lists.openembedded.org/g/openembedded-devel/message/129959 Regards, Darsh Kelaiya
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245627): https://lists.openembedded.org/g/openembedded-core/message/245627 Mute This Topic: https://lists.openembedded.org/mt/121047196/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
