<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Mar 8, 2019, 23:06 Matt Weber <<a href="mailto:matthew.weber@rockwellcollins.com">matthew.weber@rockwellcollins.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Provide guidance on setting up the *_CPE_* and *_CVE_* variables.<br>
<br>
Signed-off-by: Matthew Weber <<a href="mailto:matthew.weber@rockwellcollins.com" target="_blank" rel="noreferrer">matthew.weber@rockwellcollins.com</a>><br>
---<br>
Changes<br>
<br>
v8<br>
- Added note about minor version<br>
- Removed CVE patch listing as the backend has not be implemented<br>
(LIBFOO_CVE_PATCHED)<br>
<br>
v4 -> v7<br>
- None<br>
<br>
v3<br>
- Updated to make *_CPE_VENDOR optional<br>
- Changed wording around _CPE_ID as there is only one defined now<br>
<br>
v2<br>
[Thomas P<br>
- Reworded LIBFOO_CVE_PATCHED description<br>
<br>
[Matt W<br>
- Added definition for new preset variables to auto-gen the CPE ID<br>
- Added example LIBFOO_CPE_ID_VENDOR to LIBFOO<br>
---<br>
docs/manual/adding-packages-generic.txt | 111 +++++++++++++++++++-------------<br>
1 file changed, 68 insertions(+), 43 deletions(-)<br>
<br>
diff --git a/docs/manual/adding-packages-generic.txt b/docs/manual/adding-packages-generic.txt<br>
index 7be1754..ddf1b2e 100644<br>
--- a/docs/manual/adding-packages-generic.txt<br>
+++ b/docs/manual/adding-packages-generic.txt<br>
@@ -24,57 +24,59 @@ system is based on hand-written Makefiles or shell scripts.<br>
09: LIBFOO_SITE = <a href="http://www.foosoftware.org/download" rel="noreferrer noreferrer" target="_blank">http://www.foosoftware.org/download</a><br>
10: LIBFOO_LICENSE = GPL-3.0+<br>
11: LIBFOO_LICENSE_FILES = COPYING<br>
-12: LIBFOO_INSTALL_STAGING = YES<br>
-13: LIBFOO_CONFIG_SCRIPTS = libfoo-config<br>
-14: LIBFOO_DEPENDENCIES = host-libaaa libbbb<br>
-15:<br>
-16: define LIBFOO_BUILD_CMDS<br>
-17: $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) all<br>
-18: endef<br>
-19:<br>
-20: define LIBFOO_INSTALL_STAGING_CMDS<br>
-21: $(INSTALL) -D -m 0755 $(@D)/libfoo.a $(STAGING_DIR)/usr/lib/libfoo.a<br>
-22: $(INSTALL) -D -m 0644 $(@D)/foo.h $(STAGING_DIR)/usr/include/foo.h<br>
-23: $(INSTALL) -D -m 0755 $(@D)/libfoo.so* $(STAGING_DIR)/usr/lib<br>
-24: endef<br>
-25:<br>
-26: define LIBFOO_INSTALL_TARGET_CMDS<br>
-27: $(INSTALL) -D -m 0755 $(@D)/libfoo.so* $(TARGET_DIR)/usr/lib<br>
-28: $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/foo.d<br>
-29: endef<br>
-30:<br>
-31: define LIBFOO_USERS<br>
-32: foo -1 libfoo -1 * - - - LibFoo daemon<br>
-33: endef<br>
-34:<br>
-35: define LIBFOO_DEVICES<br>
-36: /dev/foo c 666 0 0 42 0 - - -<br>
-37: endef<br>
-38:<br>
-39: define LIBFOO_PERMISSIONS<br>
-40: /bin/foo f 4755 foo libfoo - - - - -<br>
-41: endef<br>
-42:<br>
-43: $(eval $(generic-package))<br>
+12: LIBFOO_CPE_ID_VENDOR = foosoftware<br>
+13: LIBFOO_INSTALL_STAGING = YES<br>
+14: LIBFOO_CONFIG_SCRIPTS = libfoo-config<br>
+15: LIBFOO_DEPENDENCIES = host-libaaa libbbb<br>
+16:<br>
+17: define LIBFOO_BUILD_CMDS<br>
+18: $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) all<br>
+19: endef<br>
+20:<br>
+21: define LIBFOO_INSTALL_STAGING_CMDS<br>
+22: $(INSTALL) -D -m 0755 $(@D)/libfoo.a $(STAGING_DIR)/usr/lib/libfoo.a<br>
+23: $(INSTALL) -D -m 0644 $(@D)/foo.h $(STAGING_DIR)/usr/include/foo.h<br>
+24: $(INSTALL) -D -m 0755 $(@D)/libfoo.so* $(STAGING_DIR)/usr/lib<br>
+25: endef<br>
+26:<br>
+27: define LIBFOO_INSTALL_TARGET_CMDS<br>
+28: $(INSTALL) -D -m 0755 $(@D)/libfoo.so* $(TARGET_DIR)/usr/lib<br>
+29: $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/foo.d<br>
+30: endef<br>
+31:<br>
+32: define LIBFOO_USERS<br>
+33: foo -1 libfoo -1 * - - - LibFoo daemon<br>
+34: endef<br>
+35:<br>
+36: define LIBFOO_DEVICES<br>
+37: /dev/foo c 666 0 0 42 0 - - -<br>
+38: endef<br>
+39:<br>
+40: define LIBFOO_PERMISSIONS<br>
+41: /bin/foo f 4755 foo libfoo - - - - -<br>
+42: endef<br>
+43:<br>
+44: $(eval $(generic-package))<br>
--------------------------------<br>
<br>
-The Makefile begins on line 7 to 11 with metadata information: the<br>
+The Makefile begins on line 7 to 12 with metadata information: the<br>
version of the package (+LIBFOO_VERSION+), the name of the<br>
tarball containing the package (+LIBFOO_SOURCE+) (xz-ed tarball recommended)<br>
the Internet location at which the tarball can be downloaded from<br>
-(+LIBFOO_SITE+), the license (+LIBFOO_LICENSE+) and file with the<br>
-license text (+LIBFOO_LICENSE_FILES+). All variables must start with<br>
+(+LIBFOO_SITE+), the license (+LIBFOO_LICENSE+), the file with the<br>
+license text (+LIBFOO_LICENSE_FILES+) and the vendor for vunerability<br>
+analysis (+LIBFOO_CPE_ID_VENDOR+). All variables must start with<br>
the same prefix, +LIBFOO_+ in this case. This prefix is always the<br>
uppercased version of the package name (see below to understand where<br>
the package name is defined).<br>
<br>
-On line 12, we specify that this package wants to install something to<br>
+On line 13, we specify that this package wants to install something to<br>
the staging space. This is often needed for libraries, since they must<br>
install header files and other development files in the staging space.<br>
This will ensure that the commands listed in the<br>
+LIBFOO_INSTALL_STAGING_CMDS+ variable will be executed.<br>
<br>
-On line 13, we specify that there is some fixing to be done to some<br>
+On line 14, we specify that there is some fixing to be done to some<br>
of the 'libfoo-config' files that were installed during<br>
+LIBFOO_INSTALL_STAGING_CMDS+ phase.<br>
These *-config files are executable shell script files that are<br>
@@ -122,14 +124,14 @@ IMAGEMAGICK_CONFIG_SCRIPTS = \<br>
--------------------------------<br>
================================<br>
<br>
-On line 14, we specify the list of dependencies this package relies<br>
+On line 15, we specify the list of dependencies this package relies<br>
on. These dependencies are listed in terms of lower-case package names,<br>
which can be packages for the target (without the +host-+<br>
prefix) or packages for the host (with the +host-+) prefix).<br>
Buildroot will ensure that all these packages are built and installed<br>
'before' the current package starts its configuration.<br>
<br>
-The rest of the Makefile, lines 16..29, defines what should be done<br>
+The rest of the Makefile, lines 17..29, defines what should be done<br>
at the different steps of the package configuration, compilation and<br>
installation.<br>
+LIBFOO_BUILD_CMDS+ tells what steps should be performed to<br>
@@ -142,16 +144,16 @@ All these steps rely on the +$(@D)+ variable, which<br>
contains the directory where the source code of the package has been<br>
extracted.<br>
<br>
-On lines 31..43, we define a user that is used by this package (e.g.<br>
+On lines 32..44, we define a user that is used by this package (e.g.<br>
to run a daemon as non-root) (+LIBFOO_USERS+).<br>
<br>
-On line 35..37, we define a device-node file used by this package<br>
+On line 36..38, we define a device-node file used by this package<br>
(+LIBFOO_DEVICES+).<br>
<br>
-On line 39..41, we define the permissions to set to specific files<br>
+On line 40..42, we define the permissions to set to specific files<br>
installed by this package (+LIBFOO_PERMISSIONS+).<br>
<br>
-Finally, on line 43, we call the +generic-package+ function, which<br>
+Finally, on line 44, we call the +generic-package+ function, which<br>
generates, according to the variables defined previously, all the<br>
Makefile code necessary to make your package working.<br>
<br>
@@ -482,6 +484,29 @@ not and can not work as people would expect it should:<br>
locations, `/lib/firmware`, `/usr/lib/firmware`, `/lib/modules`,<br>
`/usr/lib/modules`, and `/usr/share`, which are automatically excluded.<br>
<br>
+* +LIBFOO_CPE_ID_VENDOR+<br>
+ This variable is optional. It only must be defined if the package name<br>
+ does not match what the CPE ID uses for the vendor. By default it's set<br>
+ to <pkg-name>_project.<br>
+<br>
+* +LIBFOO_CPE_ID_NAME+<br>
+ This variable is optional. It only must be defined if the package name<br>
+ does not match what the CPE ID uses for the name. By default it's set<br>
+ to <pkg-name>.<br>
+<br>
+* +LIBFOO_CPE_ID_VERSION+<br>
+ This variable is optional. By default it's set to <pkg-version>.<br>
+<br>
+* +LIBFOO_CPE_ID_VERSION_MINOR+<br>
+ This variable is optional. By default it's set to *.<br>
+<br>
+* +LIBFOO_CPE_ID+ is optional, as the package infrastructure hangles the<br>
+ default case of a single package's Common Product Enumeration (CPE)<br>
+ identification string. +make cpe-info+ copies all of these into a<br>
+ +cpe-manifest.csv+ file. To identify a package's possible CPE,<br>
+ the National Vunerability Database can be searched at<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Also here: Vulnerability with l</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
+ <a href="https://nvd.nist.gov/products/cpe/search" rel="noreferrer noreferrer" target="_blank">https://nvd.nist.gov/products/cpe/search</a>.<br>
+<br>
The recommended way to define these variables is to use the following<br>
syntax:<br>
<br>
-- <br>
1.9.1<br>
<br>
_______________________________________________<br>
buildroot mailing list<br>
<a href="mailto:buildroot@busybox.net" target="_blank" rel="noreferrer">buildroot@busybox.net</a><br>
<a href="http://lists.busybox.net/mailman/listinfo/buildroot" rel="noreferrer noreferrer" target="_blank">http://lists.busybox.net/mailman/listinfo/buildroot</a><br>
</blockquote></div></div></div>