utils/checkpackagelib: check CPE variables (branch yem/checkpkg-cpe)

Hello All!

This series removes superfluous CPE variables that are set to their default values, and eventually adds a check-package test that ensures none crop in back in the future.

The first two patches are from Fabrice, from his initial attempt at such a check. Thanks!

Regards,
Yann E. MORIN.

----------------------------------------------------------------
Fabrice Fontaine (2):
package/containerd: drop CONTAINERD_CPE_ID_VENDOR package/libcurl: drop LIBCURL_CPE_ID_PRODUCT

Yann E. MORIN (2):
package/v4l2loopback: drop _CPE_ID_VENDOR utils/checkpackagelib: add check for CPE variables set to defautl values

 package/containerd/containerd.mk     |  1 -
 package/libcurl/libcurl.mk           |  1 -
 package/v4l2loopback/v4l2loopback.mk |  1 -
 utils/checkpackagelib/lib_mk.py      | 59 ++++++++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 3 deletions(-)

--
.-----------------.--------------------.------------------.--------------------.

|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |

'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

From: Fabrice Fontaine <[email protected]>

Commit 35af2bb8011ea57642777acf5613afa244d325d7 set CONTAINERD_CPE_ID_PRODUCT to containerd but this is not needed as CONTAINERD_CPE_ID_PRODUCT will be set to the package name (i.e. containerd) by default

---
 package/containerd/containerd.mk | 1 -
 1 file changed, 1 deletion(-)

index 61a8472ddd..d3ca102797 100644
@@ -9,7 +9,6 @@ CONTAINERD_SITE = $(call github,containerd,containerd,v$(CONTAINERD_VERSION))
 CONTAINERD_LICENSE = Apache-2.0
 CONTAINERD_LICENSE_FILES = LICENSE
 CONTAINERD_CPE_ID_VENDOR = linuxfoundation
-CONTAINERD_CPE_ID_PRODUCT = containerd
 
 CONTAINERD_GOMOD = github.com/containerd/containerd
 

2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Fabrice, All,

On 2024-02-04 16:22 +0100, Yann E. MORIN spake thusly:

Applied to master, thanks.

Regards,
Yann E. MORIN.

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

From: Fabrice Fontaine <[email protected]>

Commit 4b6202f721f2f5ab36153ba44de65286f7811ef9 set LIBCURL_CPE_ID_PRODUCT to libcurl but this is not needed as LIBCURL_CPE_ID_PRODUCT will be set to the package name (i.e. libcurl) by default

---
 package/libcurl/libcurl.mk | 1 -
 1 file changed, 1 deletion(-)

index 3ecc587a52..83845b8e87 100644
@@ -13,7 +13,6 @@ LIBCURL_DEPENDENCIES = host-pkgconf \
 LIBCURL_LICENSE = curl
 LIBCURL_LICENSE_FILES = COPYING
 LIBCURL_CPE_ID_VENDOR = haxx
-LIBCURL_CPE_ID_PRODUCT = libcurl
 LIBCURL_INSTALL_STAGING = YES
 
 # We disable NTLM delegation to winbinds ntlm_auth ('--disable-ntlm-wb')

2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Fabrice, All,

On 2024-02-04 16:22 +0100, Yann E. MORIN spake thusly:

Applied to master, thanks.

Regards,
Yann E. MORIN.

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Commit 1edb9d691dec (package/v4l2loopback: add V4L2LOOPBACK_CPE_ID_VENDOR) added that variable, but set to its default value.

This is however not required to define a valid CPE ID, as it also defines a non-default CPE_ID_PREFIX.

Drop V4L2LOOPBACK_CPE_ID_VENDOR now.

---
 package/v4l2loopback/v4l2loopback.mk | 1 -
 1 file changed, 1 deletion(-)

index 84e1927ce3..50a168fcab 100644
@@ -8,7 +8,6 @@ V4L2LOOPBACK_VERSION = 0.12.7
 V4L2LOOPBACK_SITE = $(call github,umlaeute,v4l2loopback,v$(V4L2LOOPBACK_VERSION))
 V4L2LOOPBACK_LICENSE = GPL-2.0+
 V4L2LOOPBACK_LICENSE_FILES = COPYING
-V4L2LOOPBACK_CPE_ID_VENDOR = v4l2loopback_project
 V4L2LOOPBACK_CPE_ID_PREFIX = cpe:2.3:o
 
 ifeq ($(BR2_PACKAGE_V4L2LOOPBACK_UTILS),y)

2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Committed, thanks.

Bye, Peter Korsgaard

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

The way we handle CPE variable is unsual compared to the other
variables: we mostly compute defaults for all of them, and eventually aggregate the various CPE variables to form the CPE ID name.

However, we do not consider that CPE ID to valid, unless there is one (or more) CPE variables actually set by thje package. This shows that the CPE ID has been checked to be valid against the NVD CPE database.

However, it is totally possible (and very often the case) that the default value we set to those variables are appropriate, and do defne a valid CPE ID. In this case, the package will define any arbitrary cPE variable to tis default value, usually by setting either the VENDOR or PRODUCT field, though there is no rule or requirement that be the case.

But since we only need one variable to be set, if they all are set to their default value, or one is set to a non-default value, there is no need to define the others to their default value.

So, the rules are really:

* no valid CPE ID known: define no CPE variable;

* valid CPE ID known, using all defaults fields: set a single CPE

    variable;

* valid CPE ID known, at least one CPE field id non default: only set those CPE variables that are not default.

So, we add a new check to checkpakcagelib, that ensures the above rules are met: if a CPE variable is set to its default, then it should be the only CPE variable set at all.

---
 utils/checkpackagelib/lib_mk.py | 59 +++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

index d340882971..1eb20fc04a 100644
@@ -366,3 +366,62 @@ class VariableWithBraces(_CheckFunction):
             return ["{}:{}: use $() to delimit variables, not ${{}}"
                     .format(self.filename, lineno),
                     text]
+
+
+class CPEProduct(_CheckFunction):
+    """
+    Check that the values for the CPE variables are not the default.
+    However, if there is only one such variable set, the default
+    is acceptable, because that is used to set whether the CPE info
+    is valid or not.
+    """
+    def before(self):
+        pkg, _ = os.path.splitext(os.path.basename(self.filename))
+        self.CPE_fields = {
+            "PREFIX": "cpe:2.3:a",
+            "VENDOR": f"{pkg}_project",
+            "PRODUCT": pkg,
+            "VERSION": None,
+            "UPDATE": "*",
+        }
+        self.VAR_SPLIT_RE = re.compile(
+            r"^.+_CPE_ID_({})\s*=\s*(.+)$"
+            .format("|".join(self.CPE_fields)),
+        )
+        self.nb_CPE_fields = 0
+        self.CPE_info = dict()
+        self.VERSION_RE = re.compile(
+            r"^.*_VERSION\s*=\*(.+)$",
+        )
+
+    def check_line(self, lineno, text):
+        match = self.VERSION_RE.match(text)
+        if match:
+            self.CPE_fields["VERSION"] = match.groups()[0]
+
+        match = self.VAR_SPLIT_RE.match(text)
+        if match:
+            self.nb_CPE_fields += 1
+            CPE_f, CPE_v = match.groups()
+            self.CPE_info[CPE_f] = {
+                "lineno": lineno,
+                "text": text,
+                "val": CPE_v,
+            }
+
+    def after(self):
+        if self.nb_CPE_fields <= 1:
+            return
+        defaults = list()
+        for f in self.CPE_fields:
+            if f not in self.CPE_info:
+                continue
+            lineno = self.CPE_info[f]["lineno"]
+            text = self.CPE_info[f]["text"]
+            val = self.CPE_info[f]["val"]
+            if val == self.CPE_fields[f]:
+                defaults.append(
+                    f"{self.filename}:{lineno}: {val} is the default value: {text}"
+                )
+
+        return defaults or None

2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot