GNU bug report logs - #53721
[PATCH] lint: Perform fuzzy search on package names for CVE checker.

Previous Next

Full log

Message #14 received at 53721 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Efraim Flashner <efraim <at> flashner.co.il>
Cc: Maxime Devos <maximedevos <at> telenet.be>, 53721 <at> debbugs.gnu.org
Subject: Re: bug#53721: [PATCH] lint: Perform fuzzy search on package names
 for CVE checker.
Date: Fri, 04 Feb 2022 22:56:14 +0100

Hello,

Efraim Flashner <efraim <at> flashner.co.il> skribis:

> -      (let ((name    (or (assoc-ref (package-properties package)
> -                                    'cpe-name)
> -                         (package-name package)))
> -            (version (or (assoc-ref (package-properties package)
> -                                    'cpe-version)
> -                         (package-version package))))
> +      (let* ((pkg-name (package-name package))
> +             (version  (or (assoc-ref (package-properties package)
> +                                      'cpe-version)
> +                           (package-version package)))
> +             (name
> +               (or (assoc-ref (package-properties package)
> +                              'cpe-name)
> +                   (false-if-exception
> +                     (first
> +                       (filter string?
> +                               (map (lambda (prefix)
> +                                      (when (string-prefix? prefix pkg-name)
> +                                        (string-drop pkg-name (string-length prefix))))
> +                                    '("java-" "perl-" "python-" "python2-" "ruby-")))))
> +                   pkg-name)))

I agree with Maxime’s suggestions.

In addition, I’d suggest moving this code out in two procedures,
‘package-cpe-name’ and ‘package-cpe-version’, that would honor the
relevant property and fall back to stripping prefixes.

Then ‘package-vulnerabilities’ would simply call these two procedures.

How does that sound?

Longer-term, we should add a thing that proposes correct CPE names:

  https://issues.guix.gnu.org/42299

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.