* doc/guix.texi (Invoking guix lint): Add cpe-version to example.
* doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.
---
 doc/guix.texi | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 637c9c3f4..f0b666b9e 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -6835,15 +6835,31 @@ where @code{CVE-YYYY-ABCD} is the CVE identifier---e.g.,
 
 Package developers can specify in package recipes the
 @uref{https://nvd.nist.gov/cpe.cfm,Common Platform Enumeration (CPE)}
-name and version of the package when they differ from the name that Guix
-uses, as in this example:
+name and version of the package when they differ from the name or version
+that Guix uses, as in this example:
 
 @example
 (package
   (name "grub")
   ;; @dots{}
   ;; CPE calls this package "grub2".
-  (properties '((cpe-name . "grub2"))))
+  (properties '((cpe-name . "grub2")
+                (cpe-version . "2.3")))
+@end example
+
+Sometimes, the CVE database contains false positives.  Package developers who
+found CVE alerts and verified they can be ignored can declare them as in
+this example:
+
+@example
+(package
+  (name "t1lib")
+  ;; @dots{}
+  ;; These CVEs are false positives and can be ignored:
+    (properties `((lint-hidden-cve . ("CVE-2011-0433"
+                                     "CVE-2011-1553"
+                                     "CVE-2011-1554"
+                                     "CVE-2011-5244")))))
 @end example
 
 @item formatting
-- 
2.17.0