From d4acf5377e82fc75617a28c7fb21f6bd210385e3 Mon Sep 17 00:00:00 2001 From: Sebastien Guillaume Date: Fri, 12 Jun 2026 12:15:56 +0000 Subject: [PATCH] package/gcc/gcc-initial: add CPE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gcc-final already had a CPE. The resulting CPE ID is: cpe:2.3:a:gnu:gcc:15.3.0:-:*:*:*:*:*:* The vendor and product are valid, see e.g. https://nvd.nist.gov/vuln/detail/CVE-2019-15847 Signed-off-by: Sebastien Guillaume Signed-off-by: Arnout Vandecappelle (cherry picked from commit 32d08d194509a454c80fdffa7657c9564fdddec7) Signed-off-by: Raphaël Mélotte --- package/gcc/gcc-initial/gcc-initial.mk | 3 +++ 1 file changed, 3 insertions(+) diff --git a/package/gcc/gcc-initial/gcc-initial.mk b/package/gcc/gcc-initial/gcc-initial.mk index 18d5cef0f8..3c484c901f 100644 --- a/package/gcc/gcc-initial/gcc-initial.mk +++ b/package/gcc/gcc-initial/gcc-initial.mk @@ -10,6 +10,9 @@ GCC_INITIAL_SOURCE = $(GCC_SOURCE) HOST_GCC_INITIAL_LICENSE = $(HOST_GCC_LICENSE) HOST_GCC_INITIAL_LICENSE_FILES = $(HOST_GCC_LICENSE_FILES) +GCC_INITIAL_CPE_ID_VENDOR = gnu +GCC_INITIAL_CPE_ID_PRODUCT = gcc + # We do not have a 'gcc' package per-se; we only have two incarnations, # gcc-initial and gcc-final. gcc-initial is just an internal step that # users should not care about, while gcc-final is the one they shall see.