On Wed, Sep 16, 2026 at 03:53:38PM +0200, Alexander Dahl via ptxdist wrote: > Hello, > > Am Mon, Sep 14, 2026 at 02:12:48PM +0200 schrieb Alexander Dahl via ptxdist: > > Link: > > https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:boost:boost > > Signed-off-by: Alexander Dahl <[email protected]> > > --- > > rules/boost.make | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/rules/boost.make b/rules/boost.make > > index a3b453efb..fbf6b477c 100644 > > --- a/rules/boost.make > > +++ b/rules/boost.make > > @@ -24,6 +24,8 @@ BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX) > > BOOST_DIR := $(BUILDDIR)/$(BOOST) > > BOOST_LICENSE := BSL-1.0 > > BOOST_LICENSE_FILES := > > file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c > > +BOOST_CVE_PRODUCT := boost:boost > > +BOOST_CVE_VERSION := $(subst _,.,$(BOOST_VERSION)) > > Maybe it's better to set BOOST_VERSION to the variant with dots like > 1.89.0 and use `subst` for $(BOOST)?
I like that better. In general I think we should avoid having a different version and CVE_VERSION if possible. I think the only exception should be things like openssh where the version is split into two parts. > This way file and folder names > stay the same as before like 1_89_0 and the variant in the usual > format with dots ends up in for example SBOM files? I don't think the folder name really matters, but the source file name should stay the same. > An alternative section would look like this: > > BOOST_VERSION := 1.89.0 > BOOST_MD5 := e7414f68f1cb3fd834fc155c7a009aa6 > BOOST := boost_$(subst .,_,$(BOOST_VERSION)) > BOOST_SUFFIX := tar.bz2 > BOOST_URL := $(call ptx/mirror, SF, > boost/$(BOOST_VERSION)/$(BOOST).$(BOOST_SUFFIX)) > BOOST_SOURCE := $(SRCDIR)/$(BOOST).$(BOOST_SUFFIX) > BOOST_DIR := $(BUILDDIR)/$(BOOST) > BOOST_LICENSE := BSL-1.0 > BOOST_LICENSE_FILES := > file://LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c > BOOST_CVE_PRODUCT := boost:boost > > Note, we can add the subfolder in BOOST_URL now, one less redirect. That is a nice side effect. > Not sure if I thought about all implications though. ^^ I don't think there are any other relevant effects, so please send a patch that changes the BOOST_VERSION instead. Regards, Michael -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
