Subject: Re: [bug#74034] [PATCH v6 01/16] cve: Add cpe-vendor and lint-hidden-cpe-vendors properties.

From: Ludovic Courtès <[email-masked]>
Date: Thu, 09 Jan 2025 14:48:29 +0100

Hi,

Nicolas Graves <[email-masked]> skribis:

>>> On 2024-11-29 13:51, Ludovic Courtès wrote:
>>>
>>>> Nicolas Graves <[email-masked]> skribis:
>>>>
>>>>
>>>> ‘sexp-v1->vulnerability’ has yet to be written, if I’m not mistaken.
>>>>
>>>> (Perhaps I wasn’t clear: you need to implement this procedure such that,
>>>> when reading v1 data from ~/.cache, you still get valid <vulnerability>
>>>> records.)
>
> Is that actually necessary ?  Since the vulnerability-packages field is
> an sexp, vulnerability->sexp would be the same for v1 and v2.
>
> Seems like the place to handle this is rather the second match in the
> vulnerabilities->lookup-proc procedure, that should have a second case
> match (the previous one from version history most probably) that is
> accounting for the v1.
>
> WDYT?

What I’m suggesting here is a pattern commonly used in Guix where:

  1. There’s only one in-memory representation.

  2. There may be several on-disk representations, but we convert them
     once for all when reading them.

You can find this pattern in manifests, for instance with
‘sexp->manifest’.

That’s why I’m suggesting that ‘vulnerability->sexp’ converts to the
right in-memory representation when it’s reading a v1 sexp.

Does that make sense?

Ludo’.