The current product-only "m2crypto" mapping generates a wildcard-vendor
identity instead of the two vendors used for the packaged source.
Use "heikkitoivonen:m2crypto" and "m2crypto_project:m2crypto" for their
exact NVD dictionary CPE and NVD configuration identities. This changes
the generated CPE set, but sbom-cve-check 1.3.3 with the pinned NVD
snapshot has no current CVE report delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
==========
- defer unavailable ENGINE constant lookup
- fixes problematic behaviour of pkcs11-provider
- support TLS 1.0 contexts with modern OpenSSL
- use Python 3 C APIs in handwritten SWIG code
- feat: Add AES-GCM (AEAD) support to M2Crypto
- remove Black configuration from setup.cfg
- release X509V3 config with its context
- keep IOBuffer chains alive until destruction
- test: free low-level OpenSSL objects in leak tests
- avoid leaking X509V3 extension config
- free RSA exponent on modulus conversion failure
- free replaced EVP digest contexts
- wrap created X509 name entries with ownership
- own ASN1 values created from Python data
- own PKCS7 certificate stack copies
- release BIOs on explicit close
- Add AuthorityKeyIdentifier extension support
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Devansh Patel
Wang Mingyu