[Midnightbsd-cvs] [MidnightBSD/mports] 4d7174: x11-servers/xwayland: add CPE identifier so mport ...

[Lucas Holt]

  Branch: refs/heads/security/vuxml
  Home:   https://github.com/MidnightBSD/mports
  Commit: 4d717427abbec333cc38f76badca684b4e0509c5
      https://github.com/MidnightBSD/mports/commit/4d717427abbec333cc38f76badca684b4e0509c5
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-05 (Wed, 05 Aug 2026)

  Changed paths:
    M x11-servers/xwayland/Makefile

  Log Message:
  -----------
  x11-servers/xwayland: add CPE identifier so mport audit can see it

mport audit matches installed packages against sec.midnightbsd.org by CPE
(api/cpe/partial-match). The package was shipping an empty cpe field, so audit
could not report Xwayland vulnerabilities at any version.

NVD tracks Xwayland as cpe:2.3:a:x.org:xwayland, with 16 CVEs recorded
including CVE-2023-6816, CVE-2024-0229 and CVE-2024-0409. The package now
carries cpe:2.3:a:x.org:xwayland:24.1.13:::::midnightbsd4:x64:1.

Found by sweeping the x11 categories for ports without a CPE and checking each
candidate identifier against the audit API. Of 833 such ports only six matched
anything, and five of those were name collisions with unrelated software
(x11/bitmap vs the wernsey/bitmap image library, x11/xcb vs the Rust xcb
crate, x11-fonts/hermit vs a WordPress plugin, and the x11/gnome and x11/kde
metaports against the generic gnome and kde identifiers). Those were left
alone: a wrong CPE makes audit report vulnerabilities in software the user is
not running, which is worse than reporting nothing.

PORTREVISION bumped so the rebuilt package picks up the metadata.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: a05ee84a1185fd8c21b0ebf366033832e5b782b0
      https://github.com/MidnightBSD/mports/commit/a05ee84a1185fd8c21b0ebf366033832e5b782b0
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-05 (Wed, 05 Aug 2026)

  Changed paths:
    M x11/nvidia-driver-304/Makefile
    M x11/nvidia-driver-340/Makefile
    M x11/nvidia-driver-390/Makefile
    M x11/nvidia-driver-470/Makefile
    M x11/nvidia-driver-devel/Makefile
    M x11/nvidia-driver/Makefile

  Log Message:
  -----------
  x11/nvidia-driver: add CPE identifier so mport audit can see it

mport audit matches installed packages against sec.midnightbsd.org by CPE, and
these packages shipped an empty cpe field, so audit could not report NVIDIA
driver vulnerabilities at any version.

NVD files the driver as nvidia:gpu_driver rather than by the port name, which
is why a name-based sweep does not find it; the identifier is taken from the
FreeBSD port, which has carried it for some time. There are 127 CVEs recorded
against it.

Setting this in the master port covers the legacy slave ports too, each with
its own version. Checked against the audit API:

  390.157       56 CVEs
  470.256.02     6 CVEs
  580.126.09     0 CVEs (current branch is clean)

PORTREVISION bumped on the master and on each slave so the rebuilt packages
pick up the metadata.

This is a metadata-only change; CPE_STR was verified for all six ports but they
were not built.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: fb61b3d32bea1bc677329ff8a572656c0a7a3be8
      https://github.com/MidnightBSD/mports/commit/fb61b3d32bea1bc677329ff8a572656c0a7a3be8
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-06 (Thu, 06 Aug 2026)

  Changed paths:
    M x11-servers/xwayland/Makefile
    M x11/nvidia-driver-304/Makefile
    M x11/nvidia-driver-340/Makefile
    M x11/nvidia-driver-390/Makefile
    M x11/nvidia-driver-470/Makefile
    M x11/nvidia-driver-devel/Makefile
    M x11/nvidia-driver/Makefile

  Log Message:
  -----------
  Merge branch 'master' into security/vuxml


Compare: https://github.com/MidnightBSD/mports/compare/d56f29f322a4...fb61b3d32bea

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications