Date: Wed, 17 Jun 2026 18:24:38 +0200 From: decke@freebsd.org To: <makc@freebsd.org> Cc: <mat@freebsd.org>, <ports-committers@freebsd.org>, <dev-commits-ports-all@freebsd.org>, <dev-commits-ports-main@freebsd.org> Subject: Re: git: 429cf37e1a46 - main - devel/kf6-kconfig: Add CPE information Message-ID: <19ed66623e2.20b20278427173.2378932248262062619@freebsd.org> In-Reply-To: <nXNDqntDThG-9ptkPG4ysQ@freebsd.org> References: <6a31a43f.308de.2f382e74@gitrepo.freebsd.org> <a6hkx4nyayyuxni5gvzspmf6zxwz4vz7tjz5mhzr723x55dbmb@2hfsueoagobm> <ia2qafbfnpvwuxvdqowp4te33bkfgpzurq2wu7twaepbqelmqt@54a3wabvlmdf> <nXNDqntDThG-9ptkPG4ysQ@freebsd.org>
index | next in thread | previous in thread | raw e-mail
---- Am Wed, 17 Jun 2026 15:03:50 +0200 makc@freebsd.org schrieb ---- > On Wed, 17 Jun 2026 07:19:20 +0200 Mathieu Arnold wrote: > > On Wed, Jun 17, 2026 at 07:12:35AM +0200, Mathieu Arnold wrote: > > > On Wed, Jun 17, 2026 at 12:21:28AM +0300, Max Brazhnikov wrote: > > > > On Tue, 16 Jun 2026 22:17:07 +0200 > decke@freebsd.org[mailto:decke@freebsd.org] wrote: > > > > > From: Max Brazhnikov > > > > > To: > , > , > , > > > > > > Cc: "Bernhard Froehlich" > > > > > Date: Tue, 16 Jun 2026 21:58:13 +0200 > > > > > Subject: Re: git: 429cf37e1a46 - main - devel/kf6-kconfig: Add CPE > information > > > > > > > > > > > Hi Bernhard, > > > > > > > > > > > > > URL: > https://cgit.FreeBSD.org/ports/commit/?id=429cf37e1a46522f8189c027e55f2a03310d9e3a[https://cgit.FreeBSD.org/ports/commit/?id=429cf37e1a46522f8189c027e55f2a03310d9e3a] > > > > > > > > > > > > > > commit 429cf37e1a46522f8189c027e55f2a03310d9e3a > > > > > > > Author: Bernhard Froehlich > > > > > > > > AuthorDate: 2026-06-16 19:14:22 +0000 > > > > > > > Commit: Bernhard Froehlich > > > > > > > > CommitDate: 2026-06-16 19:14:22 +0000 > > > > > > > > > > > > > > devel/kf6-kconfig: Add CPE information > > > > > > > --- > > > > > > > devel/kf6-kconfig/Makefile | 3 ++- > > > > > > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > > > > > > > > > > > diff --git a/devel/kf6-kconfig/Makefile > b/devel/kf6-kconfig/Makefile > > > > > > > index fc58ea47934f..904007c3bf1b 100644 > > > > > > > --- a/devel/kf6-kconfig/Makefile > > > > > > > +++ b/devel/kf6-kconfig/Makefile > > > > > > > @@ -5,7 +5,8 @@ CATEGORIES= devel kde kde-frameworks > > > > > > > MAINTAINER= kde@FreeBSD.org[mailto:kde@FreeBSD.org] > > > > > > > COMMENT= Persistent platform-independent application settings > > > > > > > > > > > > > > -USES= cmake gl kde:6 qt:6 tar:xz > > > > > > > +USES= cmake cpe gl kde:6 qt:6 tar:xz > > > > > > > +CPE_VENDOR= kde > > > > > > > > > > > > Not needed, USES=kde already implies CPE_VENDOR. > > > > > > > > > > > > Cheers, > > > > > > Max > > > > > > > > > > Hi Max, > > > > > > > > > > without CPE_VENDOR=kde I get kconfig:kconfig which is incorrect. > > > > > > > > > > decke@dev:~/dev/freebsd-ports/devel/kf6-kconfig % make -V CPE_STR > > > > > cpe:2.3:a:kconfig:kconfig:6.26.0:::::freebsd15:x64 > > > > > > > > > > So it seems to be needed. > > > > > > > > Indeed, kde.mk sets CPE_VENDOR only if cpe.mk included after kde.mk. > > > > > > > > Does USES has to be sorted? > > > > > > It does not, but it is considered "best" practice by many, I think some > > > tooling does this. In the end, the order of USES should not matter. It > > > is probably simpler to set CPE_VENDOR in ports. > > > > Or you could add a cpe argument to USES=kde for ports that are part of > > kde, so that it sets CPE_VENDOR accordingly. > > If the ultimate goal is to provide cpe info for all ports, then for KDE > projects > it could be done globally since we already guard KDE ports (Plasma, > Frameworks, > and Applications) via CATEGORIES: > > https://people.freebsd.org/~makc/patches/0001-Uses-kde.mk-Add-CPE-info-for-KDE-projects.patch[https://people.freebsd.org/~makc/patches/0001-Uses-kde.mk-Add-CPE-info-for-KDE-projects.patch] > > Does this patch work for you? Adding CPE info to all ports is not possible since CPE entries are usually created together with the first CVE for a project. In some cases unused CPE entries exist but it's usually not clear if they are leftovers/abandoned or just reserved. Project name is somewhat predictable (except Perl, Ruby or if it has special characters in it) but vendor is a mess - a bad one. I will check the patch later but I remember that this limitation of USES order for KDE ports existed before - just forgot about it. So it's not something new actually.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19ed66623e2.20b20278427173.2378932248262062619>