Incomplete UDD import of CPE info from upstream/metadata?

[Petter Reinholdtsen <pere@hungry.com>]

Hi.

I was looking at the automatic CVE tracking a bit today, and hoped to
figure out which packages had the CPE field already in their
debian/upstream/metadata file.  But according to UDD there are none:

udd=> select * from upstream_metadata where key = 'CPE';
 source | key | value 
--------+-----+-------
(0 rows)

udd=>

Is there any other way to find the packages using the CPE field in the
metadata file without unpacking every source package in the archive?  Is
the import of d/upstream/metadata incomplete?

-- 
Happy hacking
Petter Reinholdtsen