[scarthgap] u-boot: share CVE_PRODUCT with u-boot-tools

Message ID	20260909-uboot-cve-product-scarthgap-v1-1-043b5552f230@baylibre.com
State	New
Headers	show Return-Path: <hfranco@baylibre.com> ip: 209.85.221.170, mailfrom: hfranco@baylibre.com) From: Hiago De Franco <hfranco@baylibre.com> Date: Wed, 09 Sep 2026 10:29:46 -0300 Subject: [scarthgap][PATCH] u-boot: share CVE_PRODUCT with u-boot-tools MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260909-uboot-cve-product-scarthgap-v1-1-043b5552f230@baylibre.com> To: openembedded-core@lists.openembedded.org Cc: Devansh Patel <devanshp@cisco.com>, Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>, Richard Purdie <richard.purdie@linuxfoundation.org>
Series	[scarthgap] u-boot: share CVE_PRODUCT with u-boot-tools \| expand [scarthgap] u-boot: share CVE_PRODUCT with u-boot-tools

Message ID

20260909-uboot-cve-product-scarthgap-v1-1-043b5552f230@baylibre.com

State

New

Headers

From: Hiago De Franco <hfranco@baylibre.com>
Date: Wed, 09 Sep 2026 10:29:46 -0300
Subject: [scarthgap][PATCH] u-boot: share CVE_PRODUCT with u-boot-tools
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: 
 <20260909-uboot-cve-product-scarthgap-v1-1-043b5552f230@baylibre.com>
To: openembedded-core@lists.openembedded.org
Cc: Devansh Patel <devanshp@cisco.com>,
 Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>,
 Richard Purdie <richard.purdie@linuxfoundation.org>

Series

[scarthgap] u-boot: share CVE_PRODUCT with u-boot-tools | expand

Commit Message

Hiago De Franco Sept. 9, 2026, 1:29 p.m. UTC

From: Devansh Patel <devanshp@cisco.com>

u-boot-tools builds host utilities from the same source as u-boot, but it
does not inherit the existing CVE_PRODUCT assignment and falls back to its
unrecognized recipe-name identity.  Move the mapping to u-boot-common.inc
so both recipes inherit it.

Use "u-boot:u-boot" for the CNA/CVE List V5 affected-data identity and
"denx:u-boot" for the NVD dictionary CPE and configuration identity.  The
CNA records are also covered by NVD today, but retaining both authoritative
identities permits direct matching independently of NVD enrichment.

(cherry picked from commit bc30a343627e2d207c38d2262a7b07f506259051)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
---
 meta/recipes-bsp/u-boot/u-boot-common.inc | 2 ++
 meta/recipes-bsp/u-boot/u-boot.inc        | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)


---
base-commit: 048f2f8e8864ae5861afe95ea52efc0354bfc18c
change-id: 20260909-uboot-cve-product-scarthgap-1698fad979fd

Best regards,
--  
Hiago

diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 5f6bd44ab7..27e6ac9db5 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -10,6 +10,8 @@  LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
 PE = "1"
 
+CVE_PRODUCT = "u-boot:u-boot denx:u-boot"
+
 # We use the revision in order to avoid having to fetch it from the
 # repo during parse
 SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index 00dda93b4a..7935f2b4aa 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -19,8 +19,6 @@  PACKAGECONFIG ??= "openssl"
 # a host build dependency.
 PACKAGECONFIG[openssl] = ",,openssl-native"
 
-CVE_PRODUCT = "denx:u-boot"
-
 # Allow setting an additional version string that will be picked up by the
 # u-boot build system and appended to the u-boot version.  If the .scmversion
 # file already exists it will not be overwritten.

[scarthgap] u-boot: share CVE_PRODUCT with u-boot-tools

Commit Message

Patch