[Buildroot] [PATCH v2] package/arm-trusted-firmware: add ARM_TRUSTED_FIRMWARE_CPE_ID_*

[Quentin Schulz]

Hi Heiko,

On 3/26/26 11:10 AM, Heiko Stuebner wrote:
> From: Heiko Stuebner <heiko.stuebner at cherry.de>
> 
> Trusted-Firmware has been using a number of CPE identifiers in the past
> but especially after v2.4, the correct identifier would be similar
> to cpe:2.3:o:arm:trusted_firmware-a:2.12:rc0:*:*:-:*:*:*
> 
>    https://nvd.nist.gov/products/cpe/detail/65DEC230-1CD5-40DB-903A-22537D1E44FE
> 
> Add the relevant CPE fields to the trusted-firmware package.
> 
> Signed-off-by: Heiko Stuebner <heiko.stuebner at cherry.de>
> ---
> changes in v2:
> - remove lts- from lts releases
> - remove "v" from version, to actually match version used in CPEs
> 
>   boot/arm-trusted-firmware/arm-trusted-firmware.mk | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> index b81ce0d827..c3c4a581da 100644
> --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> @@ -5,6 +5,10 @@
>   ################################################################################
>   
>   ARM_TRUSTED_FIRMWARE_VERSION = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_VERSION))
> +ARM_TRUSTED_FIRMWARE_CPE_ID_PREFIX = cpe:2.3:o
> +ARM_TRUSTED_FIRMWARE_CPE_ID_VENDOR = arm
> +ARM_TRUSTED_FIRMWARE_CPE_ID_PRODUCT = trusted_firmware-a
> +ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION = $(subst v,,$(subst lts-,,$(ARM_TRUSTED_FIRMWARE_VERSION)))

I'm wondering if it'd make sense we don't touch 
ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION if it isn't any of the 
BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_*. We don't care about 
BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION because we cannot 
know what the user's naming scheme is, so better not mess with it. Then 
for BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE, we cannot 
guarantee it actually makes sense. There are branches and tags in TF-A 
git repo which do have v or lts- prefix but also other non-version 
things in there, e.g. sandbox/lts-v2.14.1-20260202T0851, or 
dev/upstream. I think it'd make sense to not do anything about for those 
two?

Essentially a simple (NOT TESTED!):

# Better not touch user's custom version
ifneq 
($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION),y)
ARM_TRUSTED_FIRMWARE_CPE_ID_VERSION = $(subst v,,$(subst 
lts-,,$(ARM_TRUSTED_FIRMWARE_VERSION)))
endif

What do you think?

Cheers,
Quentin