Hello,
Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist:
> Link:
> https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost
> Signed-off-by: Alexander Dahl <[email protected]>
> ---
> rules/boost.make | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/rules/boost.make b/rules/boost.make
> index a3b453efb..fbf6b477c 100644
> --- a/rules/boost.make
> +++ b/rules/boost.make
> @@ -24,6 +24,8 @@ BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
> BOOST_DIR := $(BUILDDIR)/$(BOOST)
> BOOST_LICENSE := BSL-1.0
> BOOST_LICENSE_FILES :=
> file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
> +BOOST_CVE_PRODUCT := boost:boost
> +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION))
Maybe it's better to set BOOST_VERSION to the variant with dots like
1.89.0 and use `subst` for $(BOOST)? This way file and folder names
stay the same as before like 1_89_0 and the variant in the usual
format with dots ends up in for example SBOM files?
An alternative section would look like this:
BOOST_VERSION := 1.89.0
BOOST_MD5 := e7414f68f1cb3fd834fc155c7a009aa6
BOOST := boost_$(subst .,_,$(BOOST_VERSION))
BOOST_SUFFIX := tar.bz2
BOOST_URL := $(call ptx/mirror, SF,
boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX))
BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX)
BOOST_DIR := $(BUILDDIR)/$(BOOST)
BOOST_LICENSE := BSL-1.0
BOOST_LICENSE_FILES :=
file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c
BOOST_CVE_PRODUCT := boost:boost
Note, we can add the subfolder in BOOST_URL now, one less redirect.
Not sure if I thought about all implications though. ^^
Greets
Alex
