Question: What is the correct CPE for ninja?

[nanonyme]

We're having trouble matching away false positives CVE's for this project given ninja is reasonably common name. Does this project even have an assigned CPE?

[digit-google]

I don't think there is any (and I am in no way an authority on this project).

From searching the database at https://nvd.nist.gov/products/cpe/search, it looks like CMake uses [cpe:2.3:a:cmake_project:cmake:-:*:*:*:*:node.js:*:*] and GNU Make uses [cpe:2.3:a:gnu:make:-:*:*:*:*:*:*:*].

I would suggest using [cpe:2.3:a:ninja_build:ninja:-:*:*:*:*:*:*:*] as a CPE for Ninja, but frankly don't know how to register anything like that.