[bug#74034] [PATCH v6 01/16] cve: Add cpe-vendor and lint-hidden-cpe-vendors properties.

["Ludovic Courtès" <ludo@gnu.org>]

Nicolas Graves <ngraves@ngraves.fr> skribis:

> * guix/cve.scm: Exploit cpe vendors information.
> (cpe->package-name): Rename to...
> (cpe->package-identifier): Renamed from cpe->package-name. Use
> cpe_vendor:cpe_name in place or cpe_name.
> (vulnerabily-matches?): Add helper function.
> (vulnerabilities->lookup-proc): Extract cpe_name for table
> hashes. Add vendor and hidden-vendor arguments. Adapt condition to
> pass vulnerabilities to result in the fold.
> (write-cache, fetch-vulnerabilities): Update the format version.
>
> * guix/lint.scm (package-vulnerabilities): Use additional arguments
> from vulnerabilities->lookup-proc.
>
> * tests/cve.scm (%expected-vulnerabilities): Adapt variable to changes
> in guix/cve.scm.

[...]

>      (match sexp
> -      (('vulnerabilities 1 vulns)
> -       (map sexp->vulnerability vulns)))))
> +      (('vulnerabilities 2 vulns)
> +       (map sexp->vulnerability vulns))
> +      (('vulnerabilities 1 vulns)  ;old format, lacks vendor info
> +       (map sexp-v1->vulnerability vulns)))))

‘sexp-v1->vulnerability’ has yet to be written, if I’m not mistaken.

(Perhaps I wasn’t clear: you need to implement this procedure such that,
when reading v1 data from ~/.cache, you still get valid <vulnerability>
records.)

Ludo’.