On 5/3/23 8:58 AM, Richard Purdie wrote:
On Wed, 2023-05-03 at 08:51 -0400, Armin Kuster wrote:
Its time we add the CPE_NAME to os-release.

The vendor field is hardcoded to "openembedded" as it is the base
framework. We will use "DISTRO" to identify which variation of
openembedded is being used.

Signed-off-by: Armin Kuster <[email protected]>

---
V2]
Add CPE_DISTRO
Improve usage text.
---
  meta/recipes-core/os-release/os-release.bb | 17 +++++++++++++++++
  1 file changed, 17 insertions(+)

diff --git a/meta/recipes-core/os-release/os-release.bb 
b/meta/recipes-core/os-release/os-release.bb
index 860ee97224..3f93711efb 100644
--- a/meta/recipes-core/os-release/os-release.bb
+++ b/meta/recipes-core/os-release/os-release.bb
@@ -16,6 +16,7 @@ do_configure[noexec] = "1"
  #                     HOME_URL SUPPORT_URL BUG_REPORT_URL
  OS_RELEASE_FIELDS = "\
      ID ID_LIKE NAME VERSION VERSION_ID VERSION_CODENAME PRETTY_NAME \
+    CPE_NAME \
  "
  OS_RELEASE_UNQUOTED_FIELDS = "ID VERSION_ID VARIANT_ID"
@@ -25,6 +26,22 @@ VERSION = "${DISTRO_VERSION}${@' (%s)' % DISTRO_CODENAME if 'DISTRO_CODENAME' in
  VERSION_ID = "${DISTRO_VERSION}"
  VERSION_CODENAME = "${DISTRO_CODENAME}"
  PRETTY_NAME = "${DISTRO_NAME} ${VERSION}"
+
+"""
+The vendor field is hardcoded to "openembedded" deliberately. We'd
+advise developers leave it as this value to clearly identify the
+underlying build environment from which the OS was constructed. We
+understand people will want to identify themselves as the people who
+built the image, we'd suggest using the DISTRO element to do this, so
+that is customisable.
+This end result combines to mean systems can be traced back to both who
+built them and which system was used, which is ultimately the goal of
+the CPE.
+"""
+
+CPE_DISTRO ??= "${DISTRO}"
+CPE_NAME="cpe:/o:openembedded:${CPE_DISTRO}:${VERSION_ID}"
+
  BUILD_ID ?= "${DATETIME}"
  BUILD_ID[vardepsexclude] = "DATETIME"

That looks like a parsing error to me? How did you test this? :)

Looks like I didn't. Can't blame Monday for this, maybe just old age?

v3 shortly.

-armin

(needs # at the start of comment lines)

Cheers,

Richard




-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#180827): 
https://lists.openembedded.org/g/openembedded-core/message/180827
Mute This Topic: https://lists.openembedded.org/mt/98660687/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to