From c60ff6d46721df2439511e27cb4de8319637ab42 Mon Sep 17 00:00:00 2001 From: Devansh Patel Date: Tue, 1 Sep 2026 23:09:42 -0700 Subject: [PATCH] python3-py: correct CVE_PRODUCT mapping The product-only "py" mapping generates a wildcard-vendor identity instead of the exact NVD identity for the packaged pytest-dev py source. Use "pytest:py" for its NVD dictionary CPE and configuration matches. This changes the generated product identity. With sbom-cve-check 1.3.3, the current CVE report is unchanged using the pinned database snapshots; both mappings report CVE-2020-29651 and CVE-2022-42969. (From OE-Core rev: 936d774b3cf1958c210d3fbb78b91fdafcf5fe15) Signed-off-by: Devansh Patel Signed-off-by: Khem Raj (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f) Signed-off-by: Darsh Kelaiya Signed-off-by: Yoann Congal [YC: This is a cherry-pick from meta-openembedded] Signed-off-by: Paul Barker --- meta/recipes-devtools/python/python3-py_1.11.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb b/meta/recipes-devtools/python/python3-py_1.11.0.bb index a75b9c2b14..906410e9bb 100644 --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" SRC_URI[sha256sum] = "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" -CVE_PRODUCT = "py" +CVE_PRODUCT = "pytest:py" DEPENDS += "python3-setuptools-scm-native"