[v2] os-release: Add CPE_NAME

Its time we add the CPE_NAME to os-release.

The vendor field is hardcoded to "openembedded" as it is the base
framework. We will use "DISTRO" to identify which variation of
openembedded is being used.

Signed-off-by: Armin Kuster <akuster808@gmail.com>

---
V2]
Add CPE_DISTRO
Improve usage text.
---
 meta/recipes-core/os-release/os-release.bb | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

On Wed, 2023-05-03 at 08:51 -0400, Armin Kuster wrote:
> Its time we add the CPE_NAME to os-release.
> 
> The vendor field is hardcoded to "openembedded" as it is the base
> framework. We will use "DISTRO" to identify which variation of
> openembedded is being used.
> 
> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> 
> ---
> V2]
> Add CPE_DISTRO
> Improve usage text.
> ---
>  meta/recipes-core/os-release/os-release.bb | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)
> 
> diff --git a/meta/recipes-core/os-release/os-release.bb b/meta/recipes-core/os-release/os-release.bb
> index 860ee97224..3f93711efb 100644
> --- a/meta/recipes-core/os-release/os-release.bb
> +++ b/meta/recipes-core/os-release/os-release.bb
> @@ -16,6 +16,7 @@ do_configure[noexec] = "1"
>  #                     HOME_URL SUPPORT_URL BUG_REPORT_URL
>  OS_RELEASE_FIELDS = "\
>      ID ID_LIKE NAME VERSION VERSION_ID VERSION_CODENAME PRETTY_NAME \
> +    CPE_NAME \
>  "
>  OS_RELEASE_UNQUOTED_FIELDS = "ID VERSION_ID VARIANT_ID"
>  
> @@ -25,6 +26,22 @@ VERSION = "${DISTRO_VERSION}${@' (%s)' % DISTRO_CODENAME if 'DISTRO_CODENAME' in
>  VERSION_ID = "${DISTRO_VERSION}"
>  VERSION_CODENAME = "${DISTRO_CODENAME}"
>  PRETTY_NAME = "${DISTRO_NAME} ${VERSION}"
> +
> +"""
> +The vendor field is hardcoded to "openembedded" deliberately. We'd
> +advise developers leave it as this value to clearly identify the
> +underlying build environment from which the OS was constructed. We
> +understand people will want to identify themselves as the people who
> +built the image, we'd suggest using the DISTRO element to do this, so
> +that is customisable.
> +This end result combines to mean systems can be traced back to both who
> +built them and which system was used, which is ultimately the goal of
> +the CPE.
> +"""
> +
> +CPE_DISTRO ??= "${DISTRO}"
> +CPE_NAME="cpe:/o:openembedded:${CPE_DISTRO}:${VERSION_ID}"
> +
>  BUILD_ID ?= "${DATETIME}"
>  BUILD_ID[vardepsexclude] = "DATETIME"
> 

That looks like a parsing error to me? How did you test this? :)

(needs # at the start of comment lines)

Cheers,

Richard

On 5/3/23 8:58 AM, Richard Purdie wrote:
> On Wed, 2023-05-03 at 08:51 -0400, Armin Kuster wrote:
>> Its time we add the CPE_NAME to os-release.
>>
>> The vendor field is hardcoded to "openembedded" as it is the base
>> framework. We will use "DISTRO" to identify which variation of
>> openembedded is being used.
>>
>> Signed-off-by: Armin Kuster <akuster808@gmail.com>
>>
>> ---
>> V2]
>> Add CPE_DISTRO
>> Improve usage text.
>> ---
>>   meta/recipes-core/os-release/os-release.bb | 17 +++++++++++++++++
>>   1 file changed, 17 insertions(+)
>>
>> diff --git a/meta/recipes-core/os-release/os-release.bb b/meta/recipes-core/os-release/os-release.bb
>> index 860ee97224..3f93711efb 100644
>> --- a/meta/recipes-core/os-release/os-release.bb
>> +++ b/meta/recipes-core/os-release/os-release.bb
>> @@ -16,6 +16,7 @@ do_configure[noexec] = "1"
>>   #                     HOME_URL SUPPORT_URL BUG_REPORT_URL
>>   OS_RELEASE_FIELDS = "\
>>       ID ID_LIKE NAME VERSION VERSION_ID VERSION_CODENAME PRETTY_NAME \
>> +    CPE_NAME \
>>   "
>>   OS_RELEASE_UNQUOTED_FIELDS = "ID VERSION_ID VARIANT_ID"
>>   
>> @@ -25,6 +26,22 @@ VERSION = "${DISTRO_VERSION}${@' (%s)' % DISTRO_CODENAME if 'DISTRO_CODENAME' in
>>   VERSION_ID = "${DISTRO_VERSION}"
>>   VERSION_CODENAME = "${DISTRO_CODENAME}"
>>   PRETTY_NAME = "${DISTRO_NAME} ${VERSION}"
>> +
>> +"""
>> +The vendor field is hardcoded to "openembedded" deliberately. We'd
>> +advise developers leave it as this value to clearly identify the
>> +underlying build environment from which the OS was constructed. We
>> +understand people will want to identify themselves as the people who
>> +built the image, we'd suggest using the DISTRO element to do this, so
>> +that is customisable.
>> +This end result combines to mean systems can be traced back to both who
>> +built them and which system was used, which is ultimately the goal of
>> +the CPE.
>> +"""
>> +
>> +CPE_DISTRO ??= "${DISTRO}"
>> +CPE_NAME="cpe:/o:openembedded:${CPE_DISTRO}:${VERSION_ID}"
>> +
>>   BUILD_ID ?= "${DATETIME}"
>>   BUILD_ID[vardepsexclude] = "DATETIME"
>>
> That looks like a parsing error to me? How did you test this? :)

Looks like I didn't. Can't blame Monday for this, maybe just old age?

v3 shortly.

-armin
>
> (needs # at the start of comment lines)
>
> Cheers,
>
> Richard
>
>
>