On Wed Sep 2, 2026 at 8:09 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Devansh Patel <[email protected]> > > The product-only "py" mapping generates a wildcard-vendor identity > instead of the exact NVD identity for the packaged pytest-dev py > source. Use "pytest:py" for its NVD dictionary CPE and configuration > matches. > > This changes the generated product identity. With sbom-cve-check 1.3.3, > the current CVE report is unchanged using the pinned database snapshots; > both mappings report CVE-2020-29651 and CVE-2022-42969. > > Signed-off-by: Devansh Patel <[email protected]> > Signed-off-by: Khem Raj <[email protected]> > (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f) > Signed-off-by: Darsh Kelaiya <[email protected]> > --- > meta/recipes-devtools/python/python3-py_1.11.0.bb | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb > b/meta/recipes-devtools/python/python3-py_1.11.0.bb > index a75b9c2b14..906410e9bb 100644 > --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb > +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb > @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = > "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" > > SRC_URI[sha256sum] = > "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" > > -CVE_PRODUCT = "py" > +CVE_PRODUCT = "pytest:py" > > DEPENDS += "python3-setuptools-scm-native" >
Hello, As far as I can tell, this is also needed on meta-oe/wrynose. Can you send a backport there, please? Since patches 2&3/3 conflicts, I'll hold both until "python3-py: correct CVE_PRODUCT mapping" lands on meta-oe/wrynose. Baring future issues, I'll take 1/3. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245619): https://lists.openembedded.org/g/openembedded-core/message/245619 Mute This Topic: https://lists.openembedded.org/mt/121047196/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
