mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-01 04:00:16 +00:00
Code Issues Projects Releases Wiki Activity

jq: correct CVE_PRODUCT mapping

Browse Source 
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.

This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Devansh Patel
2026-08-26 10:26:42 -07:00
committed by Khem Raj
parent 4b8eedb7d2
commit 5d23770adc
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/jq/jq_1.8.2.bb
+2
View File
@@ -14,6 +14,8 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
file://run-ptest \
"
CVE_PRODUCT = "jq_project:jq jqlang:jq"
inherit autotools ptest
UPSTREAM_CHECK_GITTAGREGEX = "${BPN}-(?P<pver>\d+(\.\d+)+)"