module: add security info to module.yml #187
Conversation
zephyr/module.yml
Outdated
| - cpe:2.3:o:google:openthread:2019-12-13:*:*:*:*:*:*:* | ||
| - pkg:github/openthread/openthread |
There was a problem hiding this comment.
should it be like this instead? feels wrong to put an old version of the CPE, but I also understand that the "new" one probably doesn't "exist" until a CVE is reported against it? not sure if it's ok to basically guess? or maybe just put a wildcard even if that means people might get false positives?)
re pkg, I think the latest released version that our fork is based off of should be there too but again, not sure
| - cpe:2.3:o:google:openthread:2019-12-13:*:*:*:*:*:*:* | |
| - pkg:github/openthread/openthread | |
| - cpe:2.3:o:google:openthread:2023-07-06:*:*:*:*:*:*:* | |
| - pkg:github/openthread/openthread@thread-reference-20230706 |
There was a problem hiding this comment.
Good question, I will ask around and see if I can find a good answer...
Like you say it doesn't seem right to either use the wrong version number, or to use a CPE that doesn't "exist" yet
There was a problem hiding this comment.
Updated with your suggestion: the consensus internally is that it's better to specify the correct version number, and downstream users of the info can decide how to handle this if a CPE with this specific version does not exist yet.
mrodgers-witekio
force-pushed
the
add-security-info
branch
from
23f7f18 to
cea7eaa
Compare
zephyr/module.yml
Outdated
| @@ -30,3 +30,7 @@ name: openthread | |||
| build: | |||
| cmake-ext: True | |||
| kconfig-ext: True | |||
| security: | |||
| external-references: | |||
| - cpe:2.3:o:google:openthread:2023-07-06*:*:*:*:*:*:* | |||
There was a problem hiding this comment.
| - cpe:2.3:o:google:openthread:2023-07-06*:*:*:*:*:*:* | |
| - cpe:2.3:o:google:openthread:2023-07-06:*:*:*:*:*:* |
mrodgers-witekio
force-pushed
the
add-security-info
branch
from
cea7eaa to
fbc5b5c
Compare
Add CPE and PURL references to module.yml file for use by Zephyr's SPDX generation tool. Signed-off-by: Matt Rodgers <[email protected]>
mrodgers-witekio
force-pushed
the
add-security-info
branch
from
fbc5b5c to
a514512
Compare
|
Updated again as I was missing a |
|
This should be upstreamed as we follow the upstream branch directly. |
|
Will move to upstream repo in a sec |
Add CPE and PURL references to module.yml file for use by Zephyr's SPDX generation tool.
See github issue in Zephyr repo: zephyrproject-rtos/zephyr#53479
The CPE added is the most recent one I could find for openthread in the NIST database: https://nvd.nist.gov/products/cpe/detail/5F57440F-9CB1-4BA2-BD81-FA00F15C8441