gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

doc/meta: Fix documentation and example for update CPE field

Browse Source 
The previous claims are unsourced, since they are not supported by the
source given for CPEs.

Quoting from the 5.3.3.5 section of the NISTIR 7695 document:

> Values for this attribute SHOULD be vendor-specific alphanumeric
> strings characterizing the particular update, service pack, or
> point release of the product.

So, first, they should be ***vendor-specific***, and dare I say,
vendor-specified. But let's not trip on the carpet's flower pattern, and
instead look at evidence from data.

Using the data from `official-cpe-dictionary_v2.3.xml`, gently massaged
into a form that can be queried, we can list all known CPE expressions
for glibc.

There is only one known entry using the `update` field. It's:

```
cpe:2.3:a:gnu:glibc:2.0.5🅱️*:*:*:*:*:*
```

As such, the current example is plainly and demonstrably wrong.

```
SELECT * FROM cpe
WHERE cpe_update != ''
   AND cpe_vendor = 'gnu'
   AND cpe_product = 'glibc'
ORDER BY cpe_vendor, cpe_product, cpe_version

id    |title            |cpe_part|cpe_vendor|cpe_product|cpe_version|cpe_update|cpe_edition|cpe_language|cpe_sw_edition|cpe_target_sw|cpe_target_hw|cpe_other|
------+-----------------+--------+----------+-----------+-----------+----------+-----------+------------+--------------+-------------+-------------+---------+
460867|GNU glibc 2.0.5 B|a       |gnu       |glibc      |2.0.5      |b         |           |            |              |             |             |         |
```

Let's see good examples of `cpe_product` in contrast:

```
SELECT * FROM cpe
WHERE cpe_update != ''
   AND cpe_vendor = 'gnu'
   AND cpe_product = 'bash'
ORDER BY cpe_vendor, cpe_product, cpe_version DESC
LIMIT 10

id    |title                                                         |cpe_part|cpe_vendor|cpe_product|cpe_version|cpe_update|cpe_edition|cpe_language|cpe_sw_edition|cpe_target_sw|cpe_target_hw|cpe_other|
------+--------------------------------------------------------------+--------+----------+-----------+-----------+----------+-----------+------------+--------------+-------------+-------------+---------+
460088|GNU Bourne-Again SHell bash (GNU Bash) 4.3.30 Beta 1          |a       |gnu       |bash       |4.3.30     |beta1     |           |            |              |             |             |         |
460086|GNU Bourne-Again SHell bash (GNU Bash) 4.2.53 Beta 1          |a       |gnu       |bash       |4.2.53     |beta1     |           |            |              |             |             |         |
460081|GNU Bourne-Again SHell bash (GNU Bash) 3.2.57 Beta 1          |a       |gnu       |bash       |3.2.57     |beta1     |           |            |              |             |             |         |
460140|GNU Bourne-Again SHell bash (GNU Bash) 5.2                    |a       |gnu       |bash       |5.2        |-         |           |            |              |             |             |         |
460141|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Alpha              |a       |gnu       |bash       |5.2        |alpha     |           |            |              |             |             |         |
460142|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Beta               |a       |gnu       |bash       |5.2        |beta      |           |            |              |             |             |         |
460143|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 1|a       |gnu       |bash       |5.2        |rc1       |           |            |              |             |             |         |
460144|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 2|a       |gnu       |bash       |5.2        |rc2       |           |            |              |             |             |         |
460145|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 3|a       |gnu       |bash       |5.2        |rc3       |           |            |              |             |             |         |
460146|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 4|a       |gnu       |bash       |5.2        |rc4       |           |            |              |             |             |         |
```
This commit is contained in:
Samuel Dionne-Riel
2026-04-08 16:18:11 -04:00
parent e52e23f041
commit 8b81adddcd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/stdenv/meta.chapter.md
+2 -2
View File
@@ -291,7 +291,7 @@ Some of them are as follows:
* *vendor* - can point to the source of the package, or to Nixpkgs itself
* *product* - name of the package
* *version* - version of the package
* *update* - name of the latest update, can be a patch version for semantically versioned packages
* *update* - vendor-specific string part of the version string of the latest update (e.g. `rc1`, `beta`, etc...)
* *edition* - deprecated and should be set to `*`
You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
@@ -301,7 +301,7 @@ Any fields that don't have a value are set to either:
* `*` (ANY) when the field can match any value
* `-` (NA) when the value is not meaningful or not used in the description
For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40.1:*:*:*:*:*:*:*`.
#### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts}