From 8430ca7c28456fd94d855270c61d2511eec28c38 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 3 Nov 2025 22:11:43 +0100 Subject: [PATCH] package/pkg-generic.mk: Set _CPE_ID_UPDATE to NA by default The commit [1] set the default value of '_CPE_ID_UPDATE' to not use a wildcard by default. But instead of setting the value to '-' it set it to an empty value instead. According to document [2] section 6.1.2.1.1 the 'Not Attributed' value bind to an hyphen ('-') and the blank statement bind to the 'Any' ('*'). Because the CPE matching function was incorrect using a blank statement worked to remove the false positives but this is not correct according to the CPE documentation. [1] 53a8616460 package/pkg-generic.mk: use more sensible default value for _CPE_ID_UPDATE [2] https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf Fixes: 53a8616460e5730abe703ca5a46bae0039d548aa. Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- package/pkg-generic.mk | 2 ++ 1 file changed, 2 insertions(+) diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk index cf55101265..0a1e29a04e 100644 --- a/package/pkg-generic.mk +++ b/package/pkg-generic.mk @@ -727,6 +727,8 @@ ifeq ($$($(2)_CPE_ID_VALID),YES) ifndef $(2)_CPE_ID_UPDATE ifdef $(3)_CPE_ID_UPDATE $(2)_CPE_ID_UPDATE = $$($(3)_CPE_ID_UPDATE) + else + $(2)_CPE_ID_UPDATE = - endif endif