fix(dependency-track): allow CPE version splitting for SBOM generation#657
Merged
HarryWaschkeit merged 5 commits intoJun 17, 2026
Merged
Conversation
Component versions in CPE entries of CVEs are used differently with respect to suffixes like `p2`, `rc1` and so on: - for most components the full version (i.e. including any suffixes) is written to the CPE version field - some components however use the update CPE field for suffixes, using `-` if none is present This cannot be handled generically, so a machanism was introduced to specify the split handling for respective components. See classes/dependency-track.bbclass for a detailed description. Signed-off-by: Harry Waschkeit <44188360+HarryWaschkeit@users.noreply.github.com>
mlilien
reviewed
Jun 15, 2026
HarryWaschkeit
changed the title
HarryWaschkeit
changed the title
HarryWaschkeit
changed the title
… CPE version setting Signed-off-by: Harry Waschkeit <44188360+HarryWaschkeit@users.noreply.github.com>
mlilien
reviewed
Jun 15, 2026
…was broken (and typos) Signed-off-by: Harry Waschkeit <44188360+HarryWaschkeit@users.noreply.github.com>
Signed-off-by: Harry Waschkeit <44188360+HarryWaschkeit@users.noreply.github.com>
mlilien
reviewed
Jun 17, 2026
mlilien
left a comment
mlilien
left a comment
Contributor
There was a problem hiding this comment.
somehow the last review was not treated as one, but as a comment only
#657 (comment)
mlilien
approved these changes
Jun 17, 2026
JoergZeidler
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Component versions in CPE entries of CVEs are used differently with respect to suffixes like
p2,rc1and so on:*-if none is presentThis cannot be handled generically, so a mechanism was introduced to specify the split handling for respective components.
See classes/dependency-track.bbclass for a detailed description.