Subject: Re: [bug#74034] [PATCH v4 01/16] cve: Add cpe-vendor and lint-hidden-cpe-vendors properties.

From: Ludovic Courtès <[email-masked]>
Date: Sun, 17 Nov 2024 18:19:30 +0100

Hi!

Nicolas Graves <[email-masked]> skribis:

> * guix/cve.scm: Exploit cpe vendors information.
> (cpe->package-name): Rename to...
> (cpe->package-identifier): Renamed from cpe->package-name. Use
> cpe_vendor:cpe_name in place or cpe_name.
> (vulnerabily-matches?): Add helper function.
> (vulnerabilities->lookup-proc): Extract cpe_name for table
> hashes. Add vendor and hidden-vendor arguments. Adapt condition to
> pass vulnerabilities to result in the fold.
>
> * guix/lint.scm (package-vulnerabilities): Use additional arguments
> from vulnerabilities->lookup-proc.
>
> * tests/cve.scm (%expected-vulnerabilities): Adapt variable to changes
> in guix/cve.scm.

[...]

> -(define (cpe->package-name cpe)
> +(define (cpe->package-identifier cpe)
>    "Converts the Common Platform Enumeration (CPE) string CPE to a package
> -name, in a very naive way.  Return two values: the package name, and its
> -version string.  Return #f and #f if CPE does not look like an application CPE
> -string."
> +identifier, in a very naive way.  Return two values: the package identifier
> +(composed from the CPE vendor and the package name), and its version string.
> +Return #f and #f if CPE does not look like an application CPE string."

It returns three values now.  :-)  (Nice!)

>  (define (merge-package-lists lst)
> -  "Merge the list in LST, each of which has the form (p sexp), where P
> -is the name of a package and SEXP is an sexp that constrains matching
> -versions."
> +  "Merge the list in LST, each of which has the form (V P SEXP), where V is a
> +CPE vendor, P is the name of a package and SEXP is an sexp that constrains
> +matching versions."

Am I right that ‘vulnerability->sexp’ now includes the vendor?

In that case, the format version in ‘write-cache’ should be bumped and
‘fetch-vulnerabilities’ should be adjusted accordingly (to support v1
sexps that lack vendor info).

Ludo’.