Wrong CPE match for `air`

[biederKdo]

I'm currently getting cpe:2.3:a:adobe:air:1.61.7:*:*:*:*:*:*:* for pkg:nix/air@1.61.7 which is incorrect.

Is there a way to fix or override these false matches, e.g. via a mapping or exclusion mechanism?

[henrirosten]

@biederKdo:

Is there a way to fix or override these false matches, e.g. via a mapping or exclusion mechanism?

Not for CPEs directly. If you use them to match vulnerabilities, I believe many of the scanners allow excluding false positives, e.g. vulnxscan or vulnix.

I would like to move the sbomnix to start using CPEs from nix meta to replace the current sbomnix's own CPE module (which tries to guess the CPE given a package name and all known CPEs used by NIST).

I hope I can get to improving this in the next few weeks.