On Mon, 2026-08-24 at 04:01 -0700, Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > From: Devansh Patel <[email protected]> > > The current "binutils" mapping generates a vendor-wildcard product > identity for the packaged GNU Binutils source. > > Use "gnu:binutils", which matches the active NVD dictionary CPE, NVD > configuration criteria, and CNA affected data for the Sourceware project. > > This changes the generated identity from > cpe:2.3:*:*:binutils:2.47:*:*:*:*:*:*:* to > cpe:2.3:*:gnu:binutils:2.47:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3 > with the frozen 2026-08-10 databases has no current CVE report delta. > > Signed-off-by: Devansh Patel <[email protected]> > --- > meta/recipes-devtools/binutils/binutils_2.47.bb | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/meta/recipes-devtools/binutils/binutils_2.47.bb > b/meta/recipes-devtools/binutils/binutils_2.47.bb > index 79bcac2025..798d886614 100644 > --- a/meta/recipes-devtools/binutils/binutils_2.47.bb > +++ b/meta/recipes-devtools/binutils/binutils_2.47.bb > @@ -1,6 +1,8 @@ > require binutils.inc > require binutils-${PV}.inc > > +CVE_PRODUCT = "gnu:binutils"
Hi, We have a default CVE_PRODUCT value so that we don't have to manually maintain mappings in every recipe. Per-recipe CVE_PRODUCT assignments are useful when the default mapping either misses CVEs or matches unrelated CVEs. In this case you say there is no CVE report delta between having this CVE_PRODUCT assignment and not having it - so is there any reason it is needed? Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244386): https://lists.openembedded.org/g/openembedded-core/message/244386 Mute This Topic: https://lists.openembedded.org/mt/120901042/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
