[Midnightbsd-cvs] [MidnightBSD/mports] 2f48ba: */*: fix CPE identifiers that resolved to nothing

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 2f48ba41c2b600904c8fa6b2001f1fb6b994f31f
      https://github.com/MidnightBSD/mports/commit/2f48ba41c2b600904c8fa6b2001f1fb6b994f31f
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-07 (Fri, 07 Aug 2026)

  Changed paths:
    M archivers/ark/Makefile
    M audio/sox/Makefile
    M databases/sqlite3/Makefile
    M editors/kate/Makefile
    M graphics/okular/Makefile
    M lang/linux-rl9-python3/Makefile
    M mail/dovecot24/Makefile
    M print/a2ps/Makefile
    M print/linux-c7-cups-libs/Makefile
    M security/linux-c7-openssl-devel/Makefile
    M security/wpa_supplicant/Makefile
    M security/wpa_supplicant29/Makefile
    M www/linux-chrome/Makefile

  Log Message:
  -----------
  */*: fix CPE identifiers that resolved to nothing

These ports declared USES=cpe but the resulting vendor/product matched no NVD
entry, so mport audit stayed silent for them exactly as if no CPE had been set.
Most were cases where CPE_PRODUCT was left to default to PORTNAME, which
carries a version suffix or a linux-c7-/linux-rl9- prefix that upstream does
not use.

Corrected, with the CVE count each now reports at the version currently in the
tree:

  www/linux-chrome                 google:chrome           1932
  security/linux-c7-openssl-devel  openssl:openssl           89
  lang/linux-rl9-python3           python:python             21
  print/linux-c7-cups-libs         apple:cups                12
  security/wpa_supplicant29        w1.fi:wpa_supplicant       4
  editors/kate                     kde:kate                   1
  mail/dovecot24                   dovecot:dovecot            1
  security/wpa_supplicant          w1.fi:wpa_supplicant       0
  databases/sqlite3                sqlite:sqlite              0
  archivers/ark                    kde:ark                    0
  graphics/okular                  kde:okular                 0
  audio/sox                        sox_project:sox            0
  print/a2ps                       gnu:a2ps                   0

The zero counts are current versions with no outstanding CVEs; the identifiers
themselves resolve (sqlite:sqlite has 58 CVEs on record, kde:ark 3, gnu:a2ps 2)
so these ports will now be covered when something new lands.

databases/sqlite3 needed care: it already carried CPE_VENDOR and CPE_PRODUCT,
but inside an ".if defined(TEA)" block that is false for the main port, so the
main package fell back to the sqlite3 default. The assignments are now
unconditional.

Verified by resolving CPE_STR for every port and querying the audit API at the
port's own version. Found by extracting CPE_STR for all 1415 non-x11 ports that
declare a CPE and checking each of the 1068 distinct vendor:product pairs; 823
resolved, and the 246 that did not were reviewed for the port-name-shaped
mistakes above. The rest are current software with no CVE history and were left
alone.

devel/linux-rl9-lld and devel/linux-rl9-lldb also resolve to nothing. NVD has
no identifier for the LLVM subprojects, only llvm:llvm for the project as a
whole, so tagging them would report LLVM-wide issues against a linker and a
debugger. Left alone, consistently with the Qt submodule ports.

PORTREVISION bumped so the rebuilt packages pick up the metadata. This is a
metadata-only change; CPE_STR was verified for all 13 ports but they were not
built.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications