[bug#74034] [PATCH v6 01/16] cve: Add cpe-vendor and lint-hidden-cpe-vendors properties.

[Nicolas Graves via Guix-patches via <guix-patches@gnu.org>]

On 2025-01-09 14:48, Ludovic Courtès wrote:

> Hi,
>
>>
>> Is that actually necessary ?  Since the vulnerability-packages field is
>> an sexp, vulnerability->sexp would be the same for v1 and v2.
>>
>> Seems like the place to handle this is rather the second match in the
>> vulnerabilities->lookup-proc procedure, that should have a second case
>> match (the previous one from version history most probably) that is
>> accounting for the v1.
>>
>> WDYT?
>
> What I’m suggesting here is a pattern commonly used in Guix where:
>
>   1. There’s only one in-memory representation.
>
>   2. There may be several on-disk representations, but we convert them
>      once for all when reading them.
>
> You can find this pattern in manifests, for instance with
> ‘sexp->manifest’.
>
> That’s why I’m suggesting that ‘vulnerability->sexp’ converts to the
> right in-memory representation when it’s reading a v1 sexp.
>
> Does that make sense?

So convert v1-sexp to v2-sexp before passing it further?  The issue is
that we don't necessarily have the vendor in v1 to be able to convert it
to v2.  There are some cases where there's no vendor (don't remember if
it's #f or 'none or something else), I can put that value by default. 

-- 
Best regards,
Nicolas Graves