Bug 287306 - security/vuxml: uncorrect record for roundcube
Summary: security/vuxml: uncorrect record for roundcube
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Fernando Apesteguía
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-04 20:56 UTC by Tomáš Čiernik
Modified: 2025-06-05 16:02 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (ports-secteam)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tomáš Čiernik 2025-06-04 20:56:51 UTC 
Hello,

recently added record for roundcube is specified as

    <affects>
      <package>
        <name>roundcube</name>
        <range><lt>1.6.11</lt></range>
      </package>
    </affects>

but no such application (roundcube-1.6.*) is in portstree. Shouldn´t this be changed to something like

    <affects>
      <package>
        <name>roundcube-php81</name>
        <range><lt>1.6.11</lt></range>
      </package>
    </affects>
    <affects>
      <package>
        <name>roundcube-php82</name>
        <range><lt>1.6.11</lt></range>
      </package>
    </affects>
    <affects>
      <package>
        <name>roundcube-php83</name>
        <range><lt>1.6.11</lt></range>
      </package>
    </affects>
    <affects>
      <package>
        <name>roundcube-php84</name>
        <range><lt>1.6.11</lt></range>
      </package>
    </affects>

?
Comment 1 Fernando Apesteguía freebsd_committer freebsd_triage 2025-06-05 15:56:32 UTC 
Thanks for reporting.

Yes, ports that "USES flavors" should define the names of the flavored packages.
Comment 2 Fernando Apesteguía freebsd_committer freebsd_triage 2025-06-05 16:01:48 UTC 
Fixed,

Thanks!
Comment 3 commit-hook freebsd_committer freebsd_triage 2025-06-05 16:02:33 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=9601584a5ac74fc289663f36d23b43a3a2944e13

commit 9601584a5ac74fc289663f36d23b43a3a2944e13
Author:     Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2025-06-05 16:00:03 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2025-06-05 16:00:03 +0000

    security/vuxml: Correct roundcube entry

    Flavored ports should include all package names in the VuXML entry.

    PR:             287306
    Reported by:    Tomáš Čiernik <tomas@ciernik.sk>

 security/vuxml/vuln/2025.xml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)