[Midnightbsd-cvs] [MidnightBSD/mports] f225e7: net/samba4{16, 19}: stop USES= from clobbering cpe

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: f225e7dd805831f1e25f4b3d16bbba9cc12e75b2
      https://github.com/MidnightBSD/mports/commit/f225e7dd805831f1e25f4b3d16bbba9cc12e75b2
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-07 (Fri, 07 Aug 2026)

  Changed paths:
    M net/samba416/Makefile
    M net/samba419/Makefile

  Log Message:
  -----------
  net/samba4{16,19}: stop USES= from clobbering cpe

Both ports set "USES= cpe" near the top and then, ~85 lines later, assign
"USES=" again with the real build dependencies. The second plain assignment
overwrites the first, so cpe never reached the resolved USES and CPE_STR came
out empty. The ports declared a CPE_VENDOR and CPE_PRODUCT that were never
used.

mport audit matches by CPE, so Samba was invisible to it. With the later
assignment changed to USES+=, net/samba419 now resolves
cpe:2.3:a:samba:samba:4.19.9 and the audit API reports 63 CVEs against that
version, including CVE-2016-2124 and CVE-2019-10218.

Checked the rest of the tree for the same pattern: the only other ports with a
plain USES= after one mentioning cpe are devel/py-Jinja2, where the two
assignments are in mutually exclusive .if branches, and
net-p2p/transmission-components, where the later assignments repeat cpe. Both
resolve correctly and were left alone.

PORTREVISION bumped so the rebuilt packages pick up the metadata.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications