2727class GentooImporter (Importer ):
2828 repo_url = "git+https://anongit.gentoo.org/git/data/glsa.git"
2929 spdx_license_expression = "CC-BY-SA-4.0"
30- license_url = "https://anongit.gentoo.org/"
30+ # the license notice is at this url https://anongit.gentoo.org/ says:
31+ # The contents of this document, unless otherwise expressly stated, are licensed
32+ # under the [CC-BY-SA-4.0](https://creativecommons.org/licenses/by-sa/4.0/) license.
33+ license_url = "https://creativecommons.org/licenses/by-sa/4.0/"
3134
3235 def advisory_data (self ) -> Iterable [AdvisoryData ]:
3336 try :
@@ -42,12 +45,12 @@ def advisory_data(self) -> Iterable[AdvisoryData]:
4245 def process_file (self , file ):
4346 cves = []
4447 summary = ""
45- vuln_reference = []
48+ vuln_references = []
4649 xml_root = ET .parse (file ).getroot ()
4750 id = xml_root .attrib .get ("id" )
4851 if id :
4952 glsa = "GLSA-" + id
50- vuln_reference = [
53+ vuln_references = [
5154 Reference (
5255 reference_id = glsa ,
5356 url = f"https://security.gentoo.org/glsa/{ id } " ,
@@ -70,7 +73,7 @@ def process_file(self, file):
7073 yield AdvisoryData (
7174 aliases = [cve ],
7275 summary = summary ,
73- references = vuln_reference ,
76+ references = vuln_references ,
7477 affected_packages = affected_packages ,
7578 )
7679
@@ -89,17 +92,15 @@ def cves_from_reference(reference):
8992 def affected_and_safe_purls (affected_elem ):
9093 safe_versions = set ()
9194 affected_versions = set ()
95+ # TODO : Revisit why we are skipping some versions in gentoo importer
9296 skip_versions = {"1.3*" , "7.3*" , "7.4*" }
9397 for pkg in affected_elem :
9498 for info in pkg :
9599 if info .text in skip_versions :
96100 continue
97101 name = pkg .attrib .get ("name" )
98102 if name :
99- (
100- pkg_ns ,
101- pkg_name ,
102- ) = name .split ("/" )
103+ pkg_ns , _ , pkg_name = name .rpartition ("/" )
103104 purl = PackageURL (type = "ebuild" , name = pkg_name , namespace = pkg_ns )
104105
105106 if info .attrib .get ("range" ):
0 commit comments