From: Devansh Patel <[email protected]> The default product-only mapping generates a vendor-wildcard CPE. nghttp2:nghttp2 is the sole active NVD dictionary CPE and configuration identity, and is also used by CNA affected data for the packaged source.
This changes the generated product identity to an exact CPE, but the frozen sbom-cve-check database leaves the nine-entry CVE report unchanged, with no current CVE delta. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-support/nghttp2/nghttp2_1.70.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb b/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb index 1b09f91ce6..bfb7d4ba42 100644 --- a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb +++ b/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb @@ -10,6 +10,8 @@ SRC_URI[sha256sum] = "e05cb1388eaca3830aded4ccf20044b6e1ac1a61411dcca11b0437c428 inherit cmake manpages python3native github-releases +CVE_PRODUCT = "nghttp2:nghttp2" + PACKAGECONFIG[manpages] = "-DENABLE_DOC=ON,-DENABLE_DOC=OFF" EXTRA_OECMAKE = "-DENABLE_LIB_ONLY=ON -DENABLE_PYTHON_BINDINGS=OFF" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244321): https://lists.openembedded.org/g/openembedded-core/message/244321 Mute This Topic: https://lists.openembedded.org/mt/120933737/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
