[Midnightbsd-cvs] [MidnightBSD/mports] 77482e: x11/*: fix CPE identifiers that matched nothing

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 77482ed6c07ef3c0a23f62cc3c7da1f36b31c616
      https://github.com/MidnightBSD/mports/commit/77482ed6c07ef3c0a23f62cc3c7da1f36b31c616
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-06 (Thu, 06 Aug 2026)

  Changed paths:
    M x11-fm/konqueror/Makefile
    M x11-fonts/linux-c7-fontconfig/Makefile
    M x11-fonts/linux-rl9-fontconfig/Makefile
    M x11-toolkits/gtk20/Makefile
    M x11-toolkits/gtk30/Makefile
    M x11-toolkits/gtk40/Makefile
    M x11-toolkits/linux-c7-pango/Makefile
    M x11-toolkits/linux-c7-qt-x11/Makefile
    M x11-toolkits/linux-rl9-pango/Makefile
    M x11-wm/fvwm2/Makefile
    M x11/linux-c7-libxkbcommon/Makefile
    M x11/linux-c7-pixman/Makefile
    M x11/linux-rl9-libxkbcommon/Makefile
    M x11/linux-rl9-pixman/Makefile

  Log Message:
  -----------
  x11/*: fix CPE identifiers that matched nothing

These ports declared USES=cpe but left CPE_PRODUCT unset, so it defaulted to
PORTNAME and carried the port's version suffix or linux-c7-/linux-rl9- prefix
into the product name. The resulting identifiers matched nothing in NVD, so
mport audit stayed silent for them just as if no CPE had been set at all.

Corrected, with the coverage this restores at the versions currently in the
tree:

  x11/linux-c7-pixman            pixman:pixman            4 CVEs
  x11/linux-rl9-pixman           pixman:pixman
  x11-toolkits/linux-c7-qt-x11   qt:qt                   37 CVEs
  x11/linux-c7-libxkbcommon      xkbcommon:libxkbcommon   1 CVE (CVE-2018-15853)
  x11/linux-rl9-libxkbcommon     xkbcommon:libxkbcommon
  x11-fonts/linux-c7-fontconfig  fontconfig_project:fontconfig  1 CVE
  x11-fonts/linux-rl9-fontconfig fontconfig_project:fontconfig
  x11-toolkits/linux-c7-pango    gnome:pango
  x11-toolkits/linux-rl9-pango   gnome:pango
  x11-toolkits/gtk20             gnome:gtk
  x11-toolkits/gtk30             gnome:gtk
  x11-toolkits/gtk40             gnome:gtk
  x11-fm/konqueror               kde:konqueror
  x11-wm/fvwm2                   fvwm:fvwm

Each replacement identifier was checked against the audit API before use, and
each was confirmed to exist in NVD's data. gnome:gtk was checked at 2.24, 3.24
and 4.18 and matches nothing at those versions, so applying it to gtk30 and
gtk40 adds no false positives while giving correct coverage if NVD records
future GTK issues under it.

Ports whose existing identifier matches nothing but for which no better one
exists were left alone: Xfstt, irrlicht, mlogind, ptyxis, windowmaker,
xlockmore, linux-rl9-tk86, gnome-terminal and the remaining linux-* compat
ports. A wrong CPE is worse than none, since audit would then report
vulnerabilities in software the user is not running.

PORTREVISION bumped so the rebuilt packages pick up the metadata. This is a
metadata-only change; CPE_STR and PKGNAME were verified for all 14 ports but
they were not built.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications