diff --git a/ansible-core/PKGBUILD b/ansible-core/PKGBUILD
index 09a4b570..be90ddaf 100644
--- a/ansible-core/PKGBUILD
+++ b/ansible-core/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc='Radically simple IT automation platform'
 arch=('any')
 url='https://pypi.org/project/ansible-core'
 msys2_references=(
-  "cpe:/a:redhat:ansible"
+  "cpe: cpe:/a:redhat:ansible"
   "pypi:ansible-core"
 )
 license=('spdx:GPL-3.0-or-later')
diff --git a/ansible/PKGBUILD b/ansible/PKGBUILD
index fdbde77b..3af97ff6 100644
--- a/ansible/PKGBUILD
+++ b/ansible/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc='Official assortment of Ansible collections'
 arch=('any')
 url='https://pypi.org/project/ansible/'
 msys2_references=(
-  "cpe:/a:redhat:ansible"
+  "cpe: cpe:/a:redhat:ansible"
   "pypi:ansible"
 )
 license=('spdx:GPL-3.0-or-later')
diff --git a/apr-util/PKGBUILD b/apr-util/PKGBUILD
index cc812b4c..63573b2c 100644
--- a/apr-util/PKGBUILD
+++ b/apr-util/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="The Apache Portable Runtime"
 arch=('i686' 'x86_64')
 url="https://apr.apache.org/"
 msys2_references=(
-  "cpe:/a:apache:apr-util"
+  "cpe: cpe:/a:apache:apr-util"
 )
 makedepends=('apr-devel' 'libexpat-devel' 'libsqlite-devel' 'autotools' 'gcc' 'libxcrypt-devel')
 options=('!libtool')
diff --git a/apr/PKGBUILD b/apr/PKGBUILD
index 12cded8e..51b85d51 100644
--- a/apr/PKGBUILD
+++ b/apr/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="The Apache Portable Runtime"
 arch=('i686' 'x86_64')
 url="https://apr.apache.org/"
 msys2_references=(
-  "cpe:/a:apache:portable_runtime"
+  "cpe: cpe:/a:apache:portable_runtime"
 )
 makedepends=('libxcrypt-devel' 'libuuid-devel' 'autotools' 'gcc')
 options=('!libtool')
diff --git a/aspell/PKGBUILD b/aspell/PKGBUILD
index 73858f07..7efddfec 100644
--- a/aspell/PKGBUILD
+++ b/aspell/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="http://aspell.net/"
 msys2_repository_url="https://github.com/GNUAspell/aspell"
 msys2_references=(
-  "cpe:/a:gnu:aspell"
+  "cpe: cpe:/a:gnu:aspell"
 )
 license=('LGPL')
 groups=('libraries')
diff --git a/axel/PKGBUILD b/axel/PKGBUILD
index f2e1acb9..74697c31 100644
--- a/axel/PKGBUILD
+++ b/axel/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('GPL')
 url="https://github.com/axel-download-accelerator/axel"
 msys2_references=(
-  "cpe:/a:axel_project:axel"
+  "cpe: cpe:/a:axel_project:axel"
 )
 groups=()
 depends=('openssl' 'gettext')
diff --git a/bash/PKGBUILD b/bash/PKGBUILD
index 15b36b4c..d467dc99 100644
--- a/bash/PKGBUILD
+++ b/bash/PKGBUILD
@@ -13,7 +13,7 @@ license=('GPL')
 url="https://www.gnu.org/software/bash/bash.html"
 msys2_repository_url="https://git.savannah.gnu.org/cgit/bash.git"
 msys2_references=(
-  "cpe:/a:gnu:bash"
+  "cpe: cpe:/a:gnu:bash"
 )
 validpgpkeys=('7C0135FB088AAF6C66C650B9BB5869F064EA74AB') # Chet Ramey
 makedepends=('gettext-devel' 'libreadline-devel>=7.0' 'ncurses-devel' 'autotools' 'gcc')
diff --git a/binutils/PKGBUILD b/binutils/PKGBUILD
index 6074906c..4101f62b 100644
--- a/binutils/PKGBUILD
+++ b/binutils/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A set of programs to assemble and manipulate binary and object files"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/binutils/"
 msys2_references=(
-  "cpe:/a:gnu:binutils"
+  "cpe: cpe:/a:gnu:binutils"
 )
 license=('GPL')
 depends=('libiconv' 'libintl' 'zlib')
diff --git a/bison/PKGBUILD b/bison/PKGBUILD
index ead18111..a48cd881 100644
--- a/bison/PKGBUILD
+++ b/bison/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 license=('spdx:GPL-3.0-or-later')
 url="https://www.gnu.org/software/bison/bison.html"
 msys2_references=(
-  "cpe:/a:gnu:bison"
+  "cpe: cpe:/a:gnu:bison"
 )
 depends=('m4' 'sh' 'libiconv' 'libintl')
 options=('staticlibs')
diff --git a/brotli/PKGBUILD b/brotli/PKGBUILD
index 5d63d938..3228077e 100644
--- a/brotli/PKGBUILD
+++ b/brotli/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('MIT')
 url='https://github.com/google/brotli'
 msys2_references=(
-  "cpe:/a:google:brotli"
+  "cpe: cpe:/a:google:brotli"
 )
 depends=('gcc-libs')
 makedepends=(
diff --git a/busybox/PKGBUILD b/busybox/PKGBUILD
index 32446e0e..425c210e 100644
--- a/busybox/PKGBUILD
+++ b/busybox/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="BusyBox: The Swiss Army Knife of Embedded Linux"
 arch=('i686' 'x86_64')
 url="https://busybox.net/"
 msys2_references=(
-  "cpe:/a:busybox:busybox"
+  "cpe: cpe:/a:busybox:busybox"
 )
 license=('GPL2')
 install=busybox.install
diff --git a/bzip2/PKGBUILD b/bzip2/PKGBUILD
index b5b0e297..83f402c8 100644
--- a/bzip2/PKGBUILD
+++ b/bzip2/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('custom')
 url="http://www.bzip.org"
 msys2_references=(
-  "cpe:/a:bzip:bzip2"
+  "cpe: cpe:/a:bzip:bzip2"
 )
 makedepends=('gcc' 'patch' 'autotools')
 source=(https://sourceware.org/pub/bzip2/bzip2-${pkgver}.tar.gz
diff --git a/c-ares/PKGBUILD b/c-ares/PKGBUILD
index 674a77e9..a2e73d26 100644
--- a/c-ares/PKGBUILD
+++ b/c-ares/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://c-ares.haxx.se/"
 msys2_repository_url="https://github.com/c-ares/c-ares"
 msys2_references=(
-  "cpe:/a:c-ares:c-ares"
+  "cpe: cpe:/a:c-ares:c-ares"
 )
 license=("spdx:MIT")
 makedepends=("cmake" 'gcc')
diff --git a/clang/PKGBUILD b/clang/PKGBUILD
index c403aca6..341efa07 100644
--- a/clang/PKGBUILD
+++ b/clang/PKGBUILD
@@ -20,7 +20,7 @@ pkgdesc="C language family frontend for LLVM"
 arch=('i686' 'x86_64')
 url="https://llvm.org/"
 msys2_references=(
-  "cpe:/a:llvm:llvm"
+  "cpe: cpe:/a:llvm:llvm"
 )
 license=("custom:Apache 2.0 with LLVM Exception")
 makedepends=("cmake"
diff --git a/coreutils/PKGBUILD b/coreutils/PKGBUILD
index 48edafd7..c3431dab 100644
--- a/coreutils/PKGBUILD
+++ b/coreutils/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 license=('GPL3')
 url="https://www.gnu.org/software/coreutils"
 msys2_references=(
-  "cpe:/a:gnu:coreutils"
+  "cpe: cpe:/a:gnu:coreutils"
 )
 depends=('gmp' 'libiconv' 'libintl')
 makedepends=('groff' 'gmp-devel' 'libiconv-devel' 'gettext-devel' 'help2man' 'autotools' 'gcc')
diff --git a/cpio/PKGBUILD b/cpio/PKGBUILD
index 5f76aa1f..56b64692 100644
--- a/cpio/PKGBUILD
+++ b/cpio/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/cpio/"
 msys2_repository_url="https://git.savannah.gnu.org/cgit/cpio.git"
 msys2_references=(
-  "cpe:/a:gnu:cpio"
+  "cpe: cpe:/a:gnu:cpio"
 )
 license=('GPLv3')
 depends=('libintl')
diff --git a/cscope/PKGBUILD b/cscope/PKGBUILD
index 6c5f01cf..2220412d 100644
--- a/cscope/PKGBUILD
+++ b/cscope/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A tool for browsing source code"
 arch=("i686" "x86_64")
 url="https://cscope.sourceforge.io/"
 msys2_references=(
-  "cpe:/a:cscope:cscope"
+  "cpe: cpe:/a:cscope:cscope"
 )
 license=('BSD')
 depends=('ncurses')
diff --git a/curl/PKGBUILD b/curl/PKGBUILD
index f2dc7e35..1408c84d 100644
--- a/curl/PKGBUILD
+++ b/curl/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://curl.haxx.se"
 msys2_repository_url="https://github.com/curl/curl"
 msys2_references=(
-  "cpe:/a:haxx:curl"
+  "cpe: cpe:/a:haxx:curl"
 )
 license=('spdx:MIT')
 depends=('ca-certificates')
diff --git a/cvs/PKGBUILD b/cvs/PKGBUILD
index 4f7ca584..0203d9a7 100644
--- a/cvs/PKGBUILD
+++ b/cvs/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 license=('GPL')
 url="http://cvs.nongnu.org/"
 msys2_references=(
-  "cpe:/a:cvs:cvs"
+  "cpe: cpe:/a:cvs:cvs"
 )
 depends=('heimdal' 'zlib' 'libxcrypt' 'libopenssl')
 makedepends=('groff' 'heimdal-devel' 'zlib-devel' 'gcc' 'libxcrypt-devel' 'openssl-devel' 'autotools')
diff --git a/cyrus-sasl/PKGBUILD b/cyrus-sasl/PKGBUILD
index 998b1d40..d1932207 100644
--- a/cyrus-sasl/PKGBUILD
+++ b/cyrus-sasl/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://www.cyrusimap.org/sasl/"
 msys2_repository_url="https://github.com/cyrusimap/cyrus-sasl"
 msys2_references=(
-  "cpe:/a:cmu:cyrus-sasl"
+  "cpe: cpe:/a:cmu:cyrus-sasl"
 )
 license=('custom')
 groups=('sys-utils')
diff --git a/dash/PKGBUILD b/dash/PKGBUILD
index 1250041c..5d8061a4 100644
--- a/dash/PKGBUILD
+++ b/dash/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A POSIX compliant shell that aims to be as small as possible"
 arch=('i686' 'x86_64')
 url="http://gondor.apana.org.au/~herbert/dash/"
 msys2_references=(
-  "cpe:/a:dash:dash"
+  "cpe: cpe:/a:dash:dash"
 )
 license=('BSD')
 depends=('grep' 'sed' 'filesystem')
diff --git a/db/PKGBUILD b/db/PKGBUILD
index 188df9b8..943f41a6 100644
--- a/db/PKGBUILD
+++ b/db/PKGBUILD
@@ -6,7 +6,7 @@ pkgrel=5
 pkgdesc="The Berkeley DB embedded database system"
 url="https://www.oracle.com/technetwork/database/database-technologies/berkeleydb/overview/index.html"
 msys2_references=(
-  "cpe:/a:oracle:berkeley_db"
+  "cpe: cpe:/a:oracle:berkeley_db"
 )
 license=('custom')
 arch=('i686' 'x86_64')
diff --git a/dosfstools/PKGBUILD b/dosfstools/PKGBUILD
index 1b37a25d..aa07da13 100644
--- a/dosfstools/PKGBUILD
+++ b/dosfstools/PKGBUILD
@@ -7,7 +7,7 @@ pkgrel=1
 pkgdesc="DOS filesystem utilities"
 url="https://github.com/dosfstools/dosfstools"
 msys2_references=(
-  "cpe:/a:dosfstools_project:dosfstools"
+  "cpe: cpe:/a:dosfstools_project:dosfstools"
 )
 arch=('i686' 'x86_64')
 depends=('libiconv' 'libiconv-devel')
diff --git a/doxygen/PKGBUILD b/doxygen/PKGBUILD
index 2ed64ee4..7e86276d 100644
--- a/doxygen/PKGBUILD
+++ b/doxygen/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="http://www.doxygen.org/"
 msys2_repository_url="https://github.com/doxygen/doxygen"
 msys2_references=(
-  "cpe:/a:doxygen:doxygen"
+  "cpe: cpe:/a:doxygen:doxygen"
 )
 license=('GPL')
 depends=("gcc-libs" "libsqlite" "libiconv")
diff --git a/elinks/PKGBUILD b/elinks/PKGBUILD
index 289a08d7..435da570 100644
--- a/elinks/PKGBUILD
+++ b/elinks/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="Full-Featured Text WWW Browser (net-utils)"
 arch=("i686" "x86_64")
 url="https://github.com/rkd77/elinks"
 msys2_references=(
-  "cpe:/a:elinks:elinks"
+  "cpe: cpe:/a:elinks:elinks"
 )
 license=('GPL')
 groups=('net-utils')
diff --git a/emacs/PKGBUILD b/emacs/PKGBUILD
index 3d32f57c..a59478f0 100644
--- a/emacs/PKGBUILD
+++ b/emacs/PKGBUILD
@@ -6,7 +6,7 @@ pkgrel=2
 pkgdesc="The extensible, customizable, self-documenting, real-time display editor (msys2)"
 url="https://www.gnu.org/software/${pkgname}/"
 msys2_references=(
-  "cpe:/a:gnu:emacs"
+  "cpe: cpe:/a:gnu:emacs"
 )
 license=('GPL3')
 arch=('i686' 'x86_64')
diff --git a/etc-update/PKGBUILD b/etc-update/PKGBUILD
index 6d0c90d4..fe298f3c 100644
--- a/etc-update/PKGBUILD
+++ b/etc-update/PKGBUILD
@@ -7,7 +7,7 @@ arch=('any')
 url="https://wiki.gentoo.org/wiki/Handbook:X86/Portage/Tools#etc-update"
 msys2_repository_url="https://github.com/gentoo/portage"
 msys2_references=(
-  "cpe:/a:gentoo:portage"
+  "cpe: cpe:/a:gentoo:portage"
 )
 license=('GPL')
 depends=('bash' 'diffutils')
diff --git a/expat/PKGBUILD b/expat/PKGBUILD
index a1adda1c..5f7d844e 100644
--- a/expat/PKGBUILD
+++ b/expat/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://libexpat.github.io/"
 msys2_repository_url="https://github.com/libexpat/libexpat"
 msys2_references=(
-  "cpe:/a:libexpat_project:libexpat"
+  "cpe: cpe:/a:libexpat_project:libexpat"
 )
 license=('spdx:MIT')
 makedepends=('autotools' 'gcc')
diff --git a/expect/PKGBUILD b/expect/PKGBUILD
index 9e2e4f91..d9ae8c69 100644
--- a/expect/PKGBUILD
+++ b/expect/PKGBUILD
@@ -9,7 +9,7 @@ pkgdesc="A tool for automating interactive applications"
 arch=('i686' 'x86_64')
 url="https://www.nist.gov/el/msid/expect.cfm"
 msys2_references=(
-  "cpe:/a:don_libes:expect"
+  "cpe: cpe:/a:don_libes:expect"
 )
 license=('custom')
 depends=('tcl')
diff --git a/file/PKGBUILD b/file/PKGBUILD
index 3d083f03..f92614ea 100644
--- a/file/PKGBUILD
+++ b/file/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 license=('custom')
 url="https://www.darwinsys.com/file/"
 msys2_references=(
-  "cpe:/a:file_project:file"
+  "cpe: cpe:/a:file_project:file"
 )
 depends=('gcc-libs' 'zlib' 'libbz2' 'liblzma' 'libzstd')
 makedepends=('python' 'zlib-devel' 'libbz2-devel' 'liblzma-devel' 'libzstd-devel' 'autotools' 'gcc')
diff --git a/findutils/PKGBUILD b/findutils/PKGBUILD
index c864ad8f..7b68b9f6 100644
--- a/findutils/PKGBUILD
+++ b/findutils/PKGBUILD
@@ -10,7 +10,7 @@ depends=('libiconv' 'libintl')
 makedepends=('libiconv-devel' 'gettext-devel' 'autotools' 'gcc')
 url="https://www.gnu.org/software/findutils"
 msys2_references=(
-  "cpe:/a:gnu:findutils"
+  "cpe: cpe:/a:gnu:findutils"
 )
 source=(https://ftp.gnu.org/pub/gnu/findutils/${pkgname}-${pkgver}.tar.xz{,.sig})
 sha256sums=('a2bfb8c09d436770edc59f50fa483e785b161a3b7b9d547573cb08065fd462fe'
diff --git a/fish/PKGBUILD b/fish/PKGBUILD
index c7c65939..28068756 100644
--- a/fish/PKGBUILD
+++ b/fish/PKGBUILD
@@ -7,7 +7,7 @@ arch=('i686' 'x86_64')
 url="https://fishshell.com/"
 msys2_repository_url="https://github.com/fish-shell/fish-shell"
 msys2_references=(
-  "cpe:/a:fishshell:fish"
+  "cpe: cpe:/a:fishshell:fish"
 )
 license=('GPL2')
 groups=()
diff --git a/gawk/PKGBUILD b/gawk/PKGBUILD
index 6da6173c..6a208046 100644
--- a/gawk/PKGBUILD
+++ b/gawk/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="GNU version of awk"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/gawk/"
 msys2_references=(
-  "cpe:/a:gnu:gawk"
+  "cpe: cpe:/a:gnu:gawk"
 )
 license=('GPL')
 depends=('sh' 'mpfr' 'libintl' 'libreadline')
diff --git a/gc/PKGBUILD b/gc/PKGBUILD
index e90161cd..73cc430c 100644
--- a/gc/PKGBUILD
+++ b/gc/PKGBUILD
@@ -11,8 +11,8 @@ groups=('libraries')
 url="https://www.hboehm.info/gc/"
 msys2_repository_url="https://github.com/ivmai/bdwgc"
 msys2_references=(
-  "cpe:/a:boehm-demers-weiser:garbage_collector"
-  "cpe:/a:bdwgc_project:bdwgc"
+  "cpe: cpe:/a:boehm-demers-weiser:garbage_collector"
+  "cpe: cpe:/a:bdwgc_project:bdwgc"
 )
 license=('MIT')
 makedepends=('autotools' 'gcc')
diff --git a/gcc/PKGBUILD b/gcc/PKGBUILD
index fe9ee891..db81e76b 100644
--- a/gcc/PKGBUILD
+++ b/gcc/PKGBUILD
@@ -14,7 +14,7 @@ arch=('i686' 'x86_64')
 license=('spdx:GPL-2.0-or-later' 'spdx:GPL-3.0-or-later' 'spdx:LGPL-2.1-or-later' 'spdx:LGPL-3.0-or-later' 'spdx:GCC-exception-3.1' 'spdx:GFDL-1.3-or-later')
 url="https://gcc.gnu.org/"
 msys2_references=(
-  "cpe:/a:gnu:gcc"
+  "cpe: cpe:/a:gnu:gcc"
 )
 makedepends=('gcc' 'binutils' 'autotools'
              'mpc-devel' 'gmp-devel' 'mpfr-devel' 'isl-devel' 'zlib-devel'
diff --git a/gdb/PKGBUILD b/gdb/PKGBUILD
index 2bf68ac3..4275ee09 100644
--- a/gdb/PKGBUILD
+++ b/gdb/PKGBUILD
@@ -11,7 +11,7 @@ arch=('i686' 'x86_64')
 license=('spdx:GPL-3.0-or-later')
 url="https://www.gnu.org/software/gdb/"
 msys2_references=(
-  "cpe:/a:gnu:gdb"
+  "cpe: cpe:/a:gnu:gdb"
 )
 depends=('gcc-libs' 'zlib' 'python' 'libexpat' 'libreadline' 'mpc' 'mpfr' 'xxhash' 'libguile' 'zstd')
 #checkdepends=('dejagnu' 'bc')
diff --git a/gettext/PKGBUILD b/gettext/PKGBUILD
index f110cd24..b349bf9f 100644
--- a/gettext/PKGBUILD
+++ b/gettext/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="GNU internationalization library"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/gettext/"
 msys2_references=(
-  "cpe:/a:gnu:gettext"
+  "cpe: cpe:/a:gnu:gettext"
 )
 license=('GPL')
 makedepends=('groff' 'libiconv-devel' 'autotools' 'gcc')
diff --git a/git/PKGBUILD b/git/PKGBUILD
index a91d5cc3..c6c78606 100644
--- a/git/PKGBUILD
+++ b/git/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://git-scm.com/"
 msys2_repository_url="https://git.kernel.org/pub/scm/git/git.git"
 msys2_references=(
-  "cpe:/a:git-scm:git"
+  "cpe: cpe:/a:git-scm:git"
 )
 license=('GPL2')
 groups=('VCS')
diff --git a/glib2/PKGBUILD b/glib2/PKGBUILD
index 81fa0928..eb7be3bf 100644
--- a/glib2/PKGBUILD
+++ b/glib2/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="Common C routines used by GTK+ and other libs"
 license=('spdx:LGPL-2.1-or-later')
 url="https://gitlab.gnome.org/GNOME/glib"
 msys2_references=(
-  "cpe:/a:gnome:glib"
+  "cpe: cpe:/a:gnome:glib"
 )
 arch=('i686' 'x86_64')
 makedepends=('docbook-xsl'
diff --git a/gmp/PKGBUILD b/gmp/PKGBUILD
index 7243abd7..f5637c27 100644
--- a/gmp/PKGBUILD
+++ b/gmp/PKGBUILD
@@ -9,7 +9,7 @@ groups=('libraries')
 arch=('i686' 'x86_64')
 url="https://gmplib.org/"
 msys2_references=(
-  "cpe:/a:gmplib:gmp"
+  "cpe: cpe:/a:gmplib:gmp"
 )
 license=('LGPL3')
 makedepends=('autotools' 'gcc')
diff --git a/gnupg/PKGBUILD b/gnupg/PKGBUILD
index c9966464..7dd7e0b2 100644
--- a/gnupg/PKGBUILD
+++ b/gnupg/PKGBUILD
@@ -15,7 +15,7 @@ msys2_issue_tracker_url='https://dev.gnupg.org/maniphest'
 msys2_pgp_keys_url='https://gnupg.org/signature_key.html'
 msys2_references=(
   'cygwin: gnupg2'
-  'cpe:/a:gnupg:gnupg'
+  'cpe: cpe:/a:gnupg:gnupg'
 )
 makedepends=('gettext-devel'
              'libassuan-devel'
diff --git a/gnutls/PKGBUILD b/gnutls/PKGBUILD
index 9f644e56..c6daf719 100644
--- a/gnutls/PKGBUILD
+++ b/gnutls/PKGBUILD
@@ -11,7 +11,7 @@ license=('spdx:GPL-3.0-or-later' 'spdx:LGPL-2.1-or-later')
 url="https://www.gnutls.org/"
 msys2_repository_url="https://gitlab.com/gnutls/gnutls"
 msys2_references=(
-  "cpe:/a:gnu:gnutls"
+  "cpe: cpe:/a:gnu:gnutls"
 )
 makedepends=('gtk-doc'
              'gcc'
diff --git a/gpgme/PKGBUILD b/gpgme/PKGBUILD
index 35c830bc..fa7761ba 100644
--- a/gpgme/PKGBUILD
+++ b/gpgme/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://gnupg.org/related_software/gpgme/"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git"
 msys2_references=(
-  "cpe:/a:gnu:gpgme"
+  "cpe: cpe:/a:gnu:gpgme"
 )
 license=('LGPL')
 depends=('libassuan' 'libgpg-error' 'gnupg')
diff --git a/gradle/PKGBUILD b/gradle/PKGBUILD
index 0afc26f0..e5d2f1ea 100644
--- a/gradle/PKGBUILD
+++ b/gradle/PKGBUILD
@@ -13,7 +13,7 @@ pkgrel=1
 arch=('any')
 url='https://www.gradle.org/'
 msys2_references=(
-  'cpe:/a:gradle:gradle'
+  'cpe: cpe:/a:gradle:gradle'
 )
 license=('APACHE')
 source=("https://services.gradle.org/distributions/gradle-${pkgver}-all.zip"
diff --git a/grep/PKGBUILD b/grep/PKGBUILD
index df3aef92..c698df31 100644
--- a/grep/PKGBUILD
+++ b/grep/PKGBUILD
@@ -19,7 +19,7 @@ arch=('i686' 'x86_64')
 license=('GPL3')
 url="https://www.gnu.org/software/grep/"
 msys2_references=(
-  "cpe:/a:gnu:grep"
+  "cpe: cpe:/a:gnu:grep"
 )
 depends=('libiconv' 'libintl' 'libpcre' 'sh')
 makedepends=('texinfo' 'gettext-devel' 'libiconv-devel' 'pcre-devel' 'autotools' 'gcc')
diff --git a/groff/PKGBUILD b/groff/PKGBUILD
index 13a95f82..5c2e763d 100644
--- a/groff/PKGBUILD
+++ b/groff/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="GNU troff text-formatting system"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/groff/groff.html"
 msys2_references=(
-  "cpe:/a:gnu:groff"
+  "cpe: cpe:/a:gnu:groff"
 )
 license=('spdx:GPL-3.0-or-later')
 depends=('perl' 'gcc-libs')
diff --git a/guile/PKGBUILD b/guile/PKGBUILD
index 9f992473..e4090c7f 100644
--- a/guile/PKGBUILD
+++ b/guile/PKGBUILD
@@ -7,7 +7,7 @@ pkgrel=2
 pkgdesc="a portable, embeddable Scheme implementation written in C"
 url="https://www.gnu.org/software/guile/"
 msys2_references=(
-  "cpe:/a:gnu:guile"
+  "cpe: cpe:/a:gnu:guile"
 )
 arch=(i686 x86_64)
 license=('GPL')
diff --git a/gzip/PKGBUILD b/gzip/PKGBUILD
index 286d0eca..c6b1aec8 100644
--- a/gzip/PKGBUILD
+++ b/gzip/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="GNU compression utility"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/gzip/"
 msys2_references=(
-  "cpe:/a:gnu:gzip"
+  "cpe: cpe:/a:gnu:gzip"
 )
 license=('GPL3')
 groups=('compression')
diff --git a/heimdal/PKGBUILD b/heimdal/PKGBUILD
index f3d827c7..76825164 100644
--- a/heimdal/PKGBUILD
+++ b/heimdal/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://www.h5l.org/"
 msys2_repository_url="https://github.com/heimdal/heimdal"
 msys2_references=(
-  "cpe:/a:heimdal_project:heimdal"
+  "cpe: cpe:/a:heimdal_project:heimdal"
 )
 license=('custom')
 makedepends=('libdb-devel' 'libxcrypt-devel' 'libedit-devel' 'libsqlite-devel' 'openssl-devel' 'perl-JSON' 'python' 'autotools' 'gcc') #libldap-devel
diff --git a/icu/PKGBUILD b/icu/PKGBUILD
index 59452457..9188dbcc 100644
--- a/icu/PKGBUILD
+++ b/icu/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://icu.unicode.org"
 msys2_repository_url="https://github.com/unicode-org/icu"
 msys2_references=(
-  "cpe:/a:icu-project:international_components_for_unicode"
+  "cpe: cpe:/a:icu-project:international_components_for_unicode"
 )
 license=('spdx:ICU')
 depends=('gcc-libs' 'sh')
diff --git a/inetutils/PKGBUILD b/inetutils/PKGBUILD
index 44964c2f..4d793c8a 100644
--- a/inetutils/PKGBUILD
+++ b/inetutils/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A collection of common network programs."
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/inetutils/"
 msys2_references=(
-  "cpe:/a:gnu:inetutils"
+  "cpe: cpe:/a:gnu:inetutils"
 )
 license=('spdx:GPL-3.0-or-later')
 depends=('gcc-libs' 'libintl' 'libreadline' 'ncurses')
diff --git a/irssi/PKGBUILD b/irssi/PKGBUILD
index c65391d4..96452b1a 100644
--- a/irssi/PKGBUILD
+++ b/irssi/PKGBUILD
@@ -12,7 +12,7 @@ arch=('i686' 'x86_64')
 url="https://irssi.org/"
 msys2_repository_url="https://github.com/irssi/irssi"
 msys2_references=(
-  "cpe:/a:irssi:irssi"
+  "cpe: cpe:/a:irssi:irssi"
 )
 license=('spdx:GPL-2.0-or-later')
 depends=('openssl' 'gettext' 'perl' 'ncurses' 'glib2')
diff --git a/jansson/PKGBUILD b/jansson/PKGBUILD
index e688c848..09163b8b 100644
--- a/jansson/PKGBUILD
+++ b/jansson/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url='https://www.digip.org/jansson/'
 msys2_repository_url="https://github.com/akheron/jansson"
 msys2_references=(
-  "cpe:/a:jansson_project:jansson"
+  "cpe: cpe:/a:jansson_project:jansson"
 )
 license=('MIT')
 makedepends=('autotools' 'gcc')
diff --git a/less/PKGBUILD b/less/PKGBUILD
index 4984fe3a..682513ae 100644
--- a/less/PKGBUILD
+++ b/less/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="http://www.greenwoodsoftware.com/less"
 msys2_repository_url="https://github.com/gwsw/less"
 msys2_references=(
-  "cpe:/a:gnu:less"
+  "cpe: cpe:/a:gnu:less"
 )
 depends=('ncurses' 'libpcre2_8')
 makedepends=('ncurses-devel' 'pcre2-devel' 'autotools' 'gcc' 'groff')
diff --git a/lftp/PKGBUILD b/lftp/PKGBUILD
index b8175ae0..5514c6c7 100644
--- a/lftp/PKGBUILD
+++ b/lftp/PKGBUILD
@@ -34,7 +34,7 @@ makedepends=('gcc'
 optdepends=('perl: needed for convert-netscape-cookies and verify-file')
 url="https://lftp.yar.ru/"
 msys2_references=(
-  'cpe:/a:lftp_project:lftp'
+  'cpe: cpe:/a:lftp_project:lftp'
 )
 backup=('etc/lftp.conf')
 source=(https://lftp.yar.ru/ftp/${pkgname}-${pkgver}.tar.xz
diff --git a/libarchive/PKGBUILD b/libarchive/PKGBUILD
index 850482e8..9eaa97fe 100644
--- a/libarchive/PKGBUILD
+++ b/libarchive/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://libarchive.org/"
 msys2_repository_url="https://github.com/libarchive/libarchive"
 msys2_references=(
-  "cpe:/a:libarchive:libarchive"
+  "cpe: cpe:/a:libarchive:libarchive"
 )
 license=('BSD')
 groups=('libraries')
diff --git a/libbsd/PKGBUILD b/libbsd/PKGBUILD
index 7953919d..c2b21821 100644
--- a/libbsd/PKGBUILD
+++ b/libbsd/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc='Provides useful functions commonly found on BSD systems like strlcpy()'
 arch=('i686' 'x86_64')
 url="https://libbsd.freedesktop.org"
 msys2_references=(
-  "cpe:/a:freedesktop:libbsd"
+  "cpe: cpe:/a:freedesktop:libbsd"
 )
 license=('custom')
 depends=('libmd')
diff --git a/libevent/PKGBUILD b/libevent/PKGBUILD
index c8d61305..7b1b31e4 100644
--- a/libevent/PKGBUILD
+++ b/libevent/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://libevent.org/"
 msys2_repository_url="https://github.com/libevent/libevent"
 msys2_references=(
-  "cpe:/a:libevent_project:libevent"
+  "cpe: cpe:/a:libevent_project:libevent"
 )
 license=('spdx:BSD-3-Clause')
 makedepends=('openssl-devel' 'autotools' 'gcc')
diff --git a/libffi/PKGBUILD b/libffi/PKGBUILD
index 5230ba54..b932c6b6 100644
--- a/libffi/PKGBUILD
+++ b/libffi/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://sourceware.org/libffi/"
 msys2_repository_url="https://github.com/libffi/libffi"
 msys2_references=(
-  "cpe:/a:libffi_project:libffi"
+  "cpe: cpe:/a:libffi_project:libffi"
 )
 groups=('libraries')
 license=('MIT')
diff --git a/libgcrypt/PKGBUILD b/libgcrypt/PKGBUILD
index 96f36114..85a151ff 100644
--- a/libgcrypt/PKGBUILD
+++ b/libgcrypt/PKGBUILD
@@ -9,7 +9,7 @@ arch=(i686 x86_64)
 url="https://gnupg.org"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git"
 msys2_references=(
-  "cpe:/a:gnupg:libgcrypt"
+  "cpe: cpe:/a:gnupg:libgcrypt"
 )
 license=('LGPL')
 depends=('libgpg-error')
diff --git a/libgpg-error/PKGBUILD b/libgpg-error/PKGBUILD
index 8c23a564..d58538e4 100644
--- a/libgpg-error/PKGBUILD
+++ b/libgpg-error/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 url="https://gnupg.org"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git"
 msys2_references=(
-  "cpe:/a:gnupg:libgpg-error"
+  "cpe: cpe:/a:gnupg:libgpg-error"
 )
 license=('spdx:LGPL-2.1-or-later')
 depends=('sh' 'libiconv' 'libintl')
diff --git a/libidn/PKGBUILD b/libidn/PKGBUILD
index 92ccbb3e..0d294805 100644
--- a/libidn/PKGBUILD
+++ b/libidn/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="Implementation of the Stringprep, Punycode and IDNA specifications"
 url="https://www.gnu.org/software/libidn/"
 msys2_repository_url="https://gitlab.com/libidn/libidn"
 msys2_references=(
-  "cpe:/a:gnu:libidn"
+  "cpe: cpe:/a:gnu:libidn"
 )
 arch=('i686' 'x86_64')
 license=('GPL3' 'LGPL')
diff --git a/libidn2/PKGBUILD b/libidn2/PKGBUILD
index aa1a50e1..2b221125 100644
--- a/libidn2/PKGBUILD
+++ b/libidn2/PKGBUILD
@@ -9,7 +9,7 @@ pkgdesc="Implementation of the Stringprep, Punycode and IDNA specifications"
 url="https://www.gnu.org/software/libidn/#libidn2"
 msys2_repository_url="https://gitlab.com/libidn/libidn2"
 msys2_references=(
-  "cpe:/a:gnu:libidn2"
+  "cpe: cpe:/a:gnu:libidn2"
 )
 arch=('i686' 'x86_64')
 license=('GPL3' 'LGPL')
diff --git a/libksba/PKGBUILD b/libksba/PKGBUILD
index a67c5e2b..b365a198 100644
--- a/libksba/PKGBUILD
+++ b/libksba/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://www.gnupg.org/related_software/libksba/"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git"
 msys2_references=(
-  "cpe:/a:gnupg:libksba"
+  "cpe: cpe:/a:gnupg:libksba"
 )
 license=('spdx:LGPL-3.0-or-later OR GPL-2.0-or-later')
 makedepends=('libgpg-error-devel' 'autotools' 'gcc')
diff --git a/libpcap/PKGBUILD b/libpcap/PKGBUILD
index 14ea7db4..1132665e 100644
--- a/libpcap/PKGBUILD
+++ b/libpcap/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('BSD')
 url="https://www.tcpdump.org/"
 msys2_references=(
-  "cpe:/a:tcpdump:libpcap"
+  "cpe: cpe:/a:tcpdump:libpcap"
 )
 makedepends=('bison' 'cmake' 'flex' 'gcc' 'make' 'openssl-devel')
 source=(https://www.tcpdump.org/release/${pkgname}-${pkgver}.tar.gz
diff --git a/libssh/PKGBUILD b/libssh/PKGBUILD
index 8d61f7be..4c5b04ee 100644
--- a/libssh/PKGBUILD
+++ b/libssh/PKGBUILD
@@ -5,7 +5,7 @@ pkgrel=1
 pkgdesc='Library for accessing ssh client services through C libraries'
 url='https://www.libssh.org/'
 msys2_references=(
-  "cpe:/a:libssh:libssh"
+  "cpe: cpe:/a:libssh:libssh"
 )
 license=('spdx:LGPL-2.1+')
 arch=('i686' 'x86_64')
diff --git a/libssh2/PKGBUILD b/libssh2/PKGBUILD
index 783ef487..9c236bc2 100644
--- a/libssh2/PKGBUILD
+++ b/libssh2/PKGBUILD
@@ -6,7 +6,7 @@ pkgrel=1
 pkgdesc="A library implementing the SSH2 protocol as defined by Internet Drafts"
 url="https://libssh2.org/"
 msys2_references=(
-  "cpe:/a:libssh2:libssh2"
+  "cpe: cpe:/a:libssh2:libssh2"
 )
 groups=('libraries')
 arch=('i686' 'x86_64')
diff --git a/libtasn1/PKGBUILD b/libtasn1/PKGBUILD
index 708bd277..7f4b8d57 100644
--- a/libtasn1/PKGBUILD
+++ b/libtasn1/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('GPL3' 'LGPL')
 url="https://www.gnu.org/software/libtasn1/"
 msys2_references=(
-  "cpe:/a:gnu:libtasn1"
+  "cpe: cpe:/a:gnu:libtasn1"
 )
 makedepends=('gcc' 'patch' 'gtk-doc' 'autotools')
 source=(https://ftp.gnu.org/gnu/libtasn1/${pkgname}-${pkgver}.tar.gz{,.sig})
diff --git a/libtirpc/PKGBUILD b/libtirpc/PKGBUILD
index 8d3d0367..78af13f8 100644
--- a/libtirpc/PKGBUILD
+++ b/libtirpc/PKGBUILD
@@ -9,7 +9,7 @@ arch=('i686' 'x86_64')
 license=('BSD')
 url="https://git.linux-nfs.org/?p=steved/libtirpc.git;a=summary"
 msys2_references=(
-  "cpe:/a:libtirpc_project:libtirpc"
+  "cpe: cpe:/a:libtirpc_project:libtirpc"
 )
 makedepends=('gcc' 'patch' 'heimdal-devel' 'autotools')
 source=(https://downloads.sourceforge.net/libtirpc/libtirpc-${pkgver}.tar.bz2
diff --git a/libtool/PKGBUILD b/libtool/PKGBUILD
index 68694b21..b4ae6180 100644
--- a/libtool/PKGBUILD
+++ b/libtool/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="A generic library support script"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/libtool/"
 msys2_references=(
-  "cpe:/a:gnu:libtool"
+  "cpe: cpe:/a:gnu:libtool"
 )
 license=('spdx:GPL-2.0-or-later')
 makedepends=("gcc>=${_gccver}" 'autotools' 'help2man')
diff --git a/libunistring/PKGBUILD b/libunistring/PKGBUILD
index befc9c1b..740bf505 100644
--- a/libunistring/PKGBUILD
+++ b/libunistring/PKGBUILD
@@ -6,7 +6,7 @@ pkgrel=2
 pkgdesc="Library for manipulating Unicode strings and C strings."
 url="https://www.gnu.org/software/libunistring/"
 msys2_references=(
-  "cpe:/a:gnu:libunistring"
+  "cpe: cpe:/a:gnu:libunistring"
 )
 arch=('i686' 'x86_64')
 license=('spdx:LGPL-3.0-or-later OR GPL-2.0-or-later')
diff --git a/libuv/PKGBUILD b/libuv/PKGBUILD
index 4cc81991..17f22660 100644
--- a/libuv/PKGBUILD
+++ b/libuv/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="Multi-platform support library with a focus on asynchronous I/O"
 arch=('i686' 'x86_64')
 url="https://github.com/libuv/libuv"
 msys2_references=(
-  "cpe:/a:libuv:libuv"
+  "cpe: cpe:/a:libuv:libuv"
 )
 license=('custom')
 makedepends=('gcc' 'autotools')
diff --git a/libxml2/PKGBUILD b/libxml2/PKGBUILD
index 24fcdc55..2ca17786 100644
--- a/libxml2/PKGBUILD
+++ b/libxml2/PKGBUILD
@@ -11,7 +11,7 @@ makedepends=('gcc' 'python-devel' 'libreadline-devel'
              'liblzma-devel' 'zlib-devel' 'autotools')
 url="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/"
 msys2_references=(
-  "cpe:/a:xmlsoft:libxml2"
+  "cpe: cpe:/a:xmlsoft:libxml2"
 )
 source=("https://download.gnome.org/sources/libxml2/${pkgver%.*}/${pkgbase}-${pkgver}.tar.xz"
         https://www.w3.org/XML/Test/xmlts20130923.tar.gz
diff --git a/libxslt/PKGBUILD b/libxslt/PKGBUILD
index 13535340..b788562d 100644
--- a/libxslt/PKGBUILD
+++ b/libxslt/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="XML stylesheet transformation library"
 arch=('i686' 'x86_64')
 url="https://gitlab.gnome.org/GNOME/libxslt/-/wikis/"
 msys2_references=(
-  "cpe:/a:xmlsoft:libxslt"
+  "cpe: cpe:/a:xmlsoft:libxslt"
 )
 license=('custom')
 makedepends=('gcc' 'libxml2-devel' 'libgcrypt-devel' 'autotools')
diff --git a/libyaml/PKGBUILD b/libyaml/PKGBUILD
index 5e9df4f0..9365a48e 100644
--- a/libyaml/PKGBUILD
+++ b/libyaml/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="YAML 1.1 library"
 arch=('i686' 'x86_64')
 url="https://pyyaml.org/wiki/LibYAML"
 msys2_references=(
-  "cpe:/a:pyyaml:libyaml"
+  "cpe: cpe:/a:pyyaml:libyaml"
 )
 license=('spdx:MIT')
 makedepends=('autotools' 'gcc')
diff --git a/lynx/PKGBUILD b/lynx/PKGBUILD
index df4a06ba..7e741a47 100644
--- a/lynx/PKGBUILD
+++ b/lynx/PKGBUILD
@@ -6,7 +6,7 @@ pkgdesc="A text browser for the World Wide Web"
 url="https://lynx.invisible-island.net/"
 msys2_pgp_keys_url="https://invisible-island.net/public/public.html"
 msys2_references=(
-  "cpe:/a:lynx_project:lynx"
+  "cpe: cpe:/a:lynx_project:lynx"
 )
 arch=('i686' 'x86_64')
 license=('GPL')
diff --git a/lz4/PKGBUILD b/lz4/PKGBUILD
index 72f13cca..898bc221 100644
--- a/lz4/PKGBUILD
+++ b/lz4/PKGBUILD
@@ -9,7 +9,7 @@ makedepends=('make' 'gcc')
 url='https://lz4.github.io/lz4/'
 msys2_repository_url="https://github.com/lz4/lz4"
 msys2_references=(
-  "cpe:/a:lz4_project:lz4"
+  "cpe: cpe:/a:lz4_project:lz4"
 )
 license=('LGPL')
 source=(lz4-${pkgver}.tar.gz::"https://github.com/lz4/lz4/archive/v${pkgver}.tar.gz")
diff --git a/lzo2/PKGBUILD b/lzo2/PKGBUILD
index 617a0d75..81024e7c 100644
--- a/lzo2/PKGBUILD
+++ b/lzo2/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="Portable lossless data compression library"
 arch=('i686' 'x86_64')
 url="https://www.oberhumer.com/opensource/lzo"
 msys2_references=(
-  "cpe:/a:oberhumer:lzo2"
+  "cpe: cpe:/a:oberhumer:lzo2"
 )
 license=('GPL')
 makedepends=('gcc' 'patch' 'autotools')
diff --git a/m4/PKGBUILD b/m4/PKGBUILD
index cc3f5100..e1423266 100644
--- a/m4/PKGBUILD
+++ b/m4/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="The GNU macro processor"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/m4"
 msys2_references=(
-  "cpe:/a:gnu:m4"
+  "cpe: cpe:/a:gnu:m4"
 )
 license=('GPL3')
 depends=('bash' 'gcc-libs' 'libiconv')
diff --git a/make/PKGBUILD b/make/PKGBUILD
index 437b9350..6acd32c9 100644
--- a/make/PKGBUILD
+++ b/make/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="GNU make utility to maintain groups of programs"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/make"
 msys2_references=(
-  "cpe:/a:gnu:make"
+  "cpe: cpe:/a:gnu:make"
 )
 license=('GPL3')
 depends=('libintl' 'sh')
diff --git a/man-db/PKGBUILD b/man-db/PKGBUILD
index eb0b034a..bf898106 100644
--- a/man-db/PKGBUILD
+++ b/man-db/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A utility for reading man pages"
 arch=('i686' 'x86_64')
 url="https://www.nongnu.org/man-db/"
 msys2_references=(
-  "cpe:/a:man-db_project:man-db"
+  "cpe: cpe:/a:man-db_project:man-db"
 )
 license=('GPL' 'LGPL')
 depends=( 'bash' 'gdbm' 'zlib' 'groff' 'libpipeline' 'less')
diff --git a/man2html/PKGBUILD b/man2html/PKGBUILD
index ad79d5cb..ded9a1fb 100644
--- a/man2html/PKGBUILD
+++ b/man2html/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="A Unix manpage-to-HTML converter"
 arch=('any')
 url="https://www.nongnu.org/man2html/"
 msys2_references=(
-  "cpe:/a:man2html_project:man2html"
+  "cpe: cpe:/a:man2html_project:man2html"
 )
 license=('GPL')
 depends=('man-db' 'perl')
diff --git a/mercurial/PKGBUILD b/mercurial/PKGBUILD
index 61817f87..3c577b8d 100644
--- a/mercurial/PKGBUILD
+++ b/mercurial/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 url="https://www.mercurial-scm.org/"
 msys2_references=(
   "pypi:mercurial"
-  "cpe:/a:mercurial:mercurial"
+  "cpe: cpe:/a:mercurial:mercurial"
 )
 license=('spdx:GPL-2.0-or-later')
 groups=('VCS')
diff --git a/mingw-w64-cross-binutils/PKGBUILD b/mingw-w64-cross-binutils/PKGBUILD
index b2113743..80294729 100644
--- a/mingw-w64-cross-binutils/PKGBUILD
+++ b/mingw-w64-cross-binutils/PKGBUILD
@@ -10,7 +10,7 @@ pkgdesc="A set of programs to assemble and manipulate binary and object files"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/binutils/"
 msys2_references=(
-  "cpe:/a:gnu:binutils"
+  "cpe: cpe:/a:gnu:binutils"
 )
 license=('GPL')
 groups=("${_mingw_suff}-toolchain" "${_mingw_suff}")
diff --git a/mingw-w64-cross-clang-crt/PKGBUILD b/mingw-w64-cross-clang-crt/PKGBUILD
index f232e08f..7c18495c 100644
--- a/mingw-w64-cross-clang-crt/PKGBUILD
+++ b/mingw-w64-cross-clang-crt/PKGBUILD
@@ -19,7 +19,7 @@ source=("mingw-w64"::"git+https://git.code.sf.net/p/mingw-w64/mingw-w64#commit=$
 sha256sums=('SKIP')
 msys2_references=(
   'archlinux: mingw-w64-crt'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="x86_64-w64-mingw32 i686-w64-mingw32 armv7-w64-mingw32 aarch64-w64-mingw32"
diff --git a/mingw-w64-cross-clang-headers/PKGBUILD b/mingw-w64-cross-clang-headers/PKGBUILD
index fb7a90b5..d15eeead 100644
--- a/mingw-w64-cross-clang-headers/PKGBUILD
+++ b/mingw-w64-cross-clang-headers/PKGBUILD
@@ -18,7 +18,7 @@ source=("mingw-w64"::"git+https://git.code.sf.net/p/mingw-w64/mingw-w64#commit=$
 sha256sums=('SKIP')
 msys2_references=(
   'archlinux: mingw-w64-headers'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="i686-w64-mingw32 x86_64-w64-mingw32 armv7-w64-mingw32 aarch64-w64-mingw32"
diff --git a/mingw-w64-cross-clang/PKGBUILD b/mingw-w64-cross-clang/PKGBUILD
index 88caa887..e659ee13 100644
--- a/mingw-w64-cross-clang/PKGBUILD
+++ b/mingw-w64-cross-clang/PKGBUILD
@@ -15,7 +15,7 @@ makedepends=("clang" "cmake" "lld")
 options=('!strip' 'staticlibs' '!emptydirs' '!buildflags')
 msys2_references=(
   'archlinux: clang'
-  'cpe:/a:llvm:llvm'
+  'cpe: cpe:/a:llvm:llvm'
 )
 _url=https://github.com/llvm/llvm-project/releases/download/llvmorg-${pkgver}
 source=(${_url}/llvm-${pkgver}.src.tar.xz{,.sig}
diff --git a/mingw-w64-cross-compiler-rt/PKGBUILD b/mingw-w64-cross-compiler-rt/PKGBUILD
index b43b0c67..e6f0481f 100644
--- a/mingw-w64-cross-compiler-rt/PKGBUILD
+++ b/mingw-w64-cross-compiler-rt/PKGBUILD
@@ -11,7 +11,7 @@ url="https://llvm.org"
 license=('custom:Apache 2.0 with LLVM Exception')
 msys2_references=(
   'archlinux: compiler-rt'
-  'cpe:/a:llvm:llvm'
+  'cpe: cpe:/a:llvm:llvm'
 )
 depends=('clang')
 makedepends=("cmake" "lld" "ninja" "${_mingw_suff}-clang-headers" 'gcc')
diff --git a/mingw-w64-cross-crt/PKGBUILD b/mingw-w64-cross-crt/PKGBUILD
index 2797d2c2..207017d9 100644
--- a/mingw-w64-cross-crt/PKGBUILD
+++ b/mingw-w64-cross-crt/PKGBUILD
@@ -23,7 +23,7 @@ source=("mingw-w64"::"git+https://git.code.sf.net/p/mingw-w64/mingw-w64#commit=$
 sha256sums=('SKIP')
 msys2_references=(
   'archlinux: mingw-w64-crt'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="x86_64-w64-mingw32ucrt x86_64-w64-mingw32 i686-w64-mingw32"
diff --git a/mingw-w64-cross-gcc/PKGBUILD b/mingw-w64-cross-gcc/PKGBUILD
index 77324c85..646b20ea 100644
--- a/mingw-w64-cross-gcc/PKGBUILD
+++ b/mingw-w64-cross-gcc/PKGBUILD
@@ -11,7 +11,7 @@ url="https://gcc.gnu.org"
 license=('GPL' 'LGPL' 'FDL' 'custom')
 msys2_references=(
   'archlinux: gcc'
-  'cpe:/a:gnu:gcc'
+  'cpe: cpe:/a:gnu:gcc'
 )
 groups=("${_mingw_suff}-toolchain" "${_mingw_suff}")
 depends=("zlib" "mpc" "isl" "libzstd"
diff --git a/mingw-w64-cross-headers/PKGBUILD b/mingw-w64-cross-headers/PKGBUILD
index 10386422..b0bfc611 100644
--- a/mingw-w64-cross-headers/PKGBUILD
+++ b/mingw-w64-cross-headers/PKGBUILD
@@ -21,7 +21,7 @@ source=("mingw-w64"::"git+https://git.code.sf.net/p/mingw-w64/mingw-w64#commit=$
 sha256sums=('SKIP')
 msys2_references=(
   'archlinux: mingw-w64-headers'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="x86_64-w64-mingw32ucrt i686-w64-mingw32 x86_64-w64-mingw32"
diff --git a/mingw-w64-cross-winpthreads/PKGBUILD b/mingw-w64-cross-winpthreads/PKGBUILD
index 620f7569..979b9c9a 100644
--- a/mingw-w64-cross-winpthreads/PKGBUILD
+++ b/mingw-w64-cross-winpthreads/PKGBUILD
@@ -25,7 +25,7 @@ sha256sums=('SKIP'
             'd9e8af81682d9bf70e3d87506f51156cec61260b810a234bce861cb2eb3a5919')
 msys2_references=(
   'archlinux: mingw-w64-winpthreads'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="x86_64-w64-mingw32ucrt i686-w64-mingw32 x86_64-w64-mingw32"
diff --git a/mingw-w64-cross-winstorecompat/PKGBUILD b/mingw-w64-cross-winstorecompat/PKGBUILD
index c51b352e..a5aa3e20 100644
--- a/mingw-w64-cross-winstorecompat/PKGBUILD
+++ b/mingw-w64-cross-winstorecompat/PKGBUILD
@@ -24,7 +24,7 @@ sha256sums=('SKIP')
 msys2_references=(
   # doesn't exist in arch, this is the next best thing
   'archlinux: mingw-w64-headers'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 _targets="i686-w64-mingw32 x86_64-w64-mingw32"
diff --git a/mingw-w64-cross-zlib/PKGBUILD b/mingw-w64-cross-zlib/PKGBUILD
index bf913ded..0f98390c 100644
--- a/mingw-w64-cross-zlib/PKGBUILD
+++ b/mingw-w64-cross-zlib/PKGBUILD
@@ -24,7 +24,7 @@ sha256sums=('38ef96b8dfe510d42707d9c781877914792541133e1870841463bfa73f883e32'
             '4d8ebda55b95d19cd7c467c486d4c42d2bad6db9ff5dca361f6d8c24120e5f30')
 msys2_references=(
   'archlinux: zlib'
-  'cpe:/a:zlib:zlib'
+  'cpe: cpe:/a:zlib:zlib'
 )
 validpgpkeys=('5ED46A6721D365587791E2AA783FCD8E58BCAFBA')
 
diff --git a/mintty/PKGBUILD b/mintty/PKGBUILD
index cdf0a470..117472cc 100644
--- a/mintty/PKGBUILD
+++ b/mintty/PKGBUILD
@@ -12,7 +12,7 @@ makedepends=('gcc')
 url="https://mintty.github.io"
 msys2_repository_url="https://github.com/mintty/mintty"
 msys2_references=(
-  "cpe:/a:mintty_project:mintty"
+  "cpe: cpe:/a:mintty_project:mintty"
 )
 source=(${pkgname}-${pkgver}.tar.gz::https://github.com/mintty/mintty/archive/${pkgver}.tar.gz
         "001-default-size.patch")
diff --git a/mpfr/PKGBUILD b/mpfr/PKGBUILD
index d7dfde10..2eb8f492 100644
--- a/mpfr/PKGBUILD
+++ b/mpfr/PKGBUILD
@@ -9,7 +9,7 @@ pkgdesc="Multiple-precision floating-point library"
 arch=('i686' 'x86_64')
 url="https://www.mpfr.org/"
 msys2_references=(
-  "cpe:/a:mpfr:gnu_mpfr"
+  "cpe: cpe:/a:mpfr:gnu_mpfr"
 )
 license=('spdx:LGPL-3.0-or-later')
 depends=('gmp>=5.0')
diff --git a/msys2-runtime-3.3/PKGBUILD b/msys2-runtime-3.3/PKGBUILD
index 48506a47..76062581 100644
--- a/msys2-runtime-3.3/PKGBUILD
+++ b/msys2-runtime-3.3/PKGBUILD
@@ -10,7 +10,7 @@ arch=('i686' 'x86_64')
 url="https://www.cygwin.com/"
 msys2_references=(
   'cygwin: cygwin'
-  "cpe:/a:cygwin:cygwin"
+  "cpe: cpe:/a:cygwin:cygwin"
 )
 license=('GPL')
 makedepends=('cocom'
diff --git a/msys2-runtime-3.4/PKGBUILD b/msys2-runtime-3.4/PKGBUILD
index a56b51a0..408a879a 100644
--- a/msys2-runtime-3.4/PKGBUILD
+++ b/msys2-runtime-3.4/PKGBUILD
@@ -11,7 +11,7 @@ url="https://www.cygwin.com/"
 license=('GPL')
 msys2_references=(
   'cygwin: cygwin'
-  "cpe:/a:cygwin:cygwin"
+  "cpe: cpe:/a:cygwin:cygwin"
 )
 makedepends=('cocom'
              'git'
diff --git a/msys2-runtime-3.5/PKGBUILD b/msys2-runtime-3.5/PKGBUILD
index f2c98b95..d9090272 100644
--- a/msys2-runtime-3.5/PKGBUILD
+++ b/msys2-runtime-3.5/PKGBUILD
@@ -11,7 +11,7 @@ url="https://www.cygwin.com/"
 license=('GPL')
 msys2_references=(
   'cygwin: cygwin'
-  "cpe:/a:cygwin:cygwin"
+  "cpe: cpe:/a:cygwin:cygwin"
 )
 makedepends=('cocom'
              'git'
diff --git a/msys2-runtime/PKGBUILD b/msys2-runtime/PKGBUILD
index 4b70d903..e3a95d69 100644
--- a/msys2-runtime/PKGBUILD
+++ b/msys2-runtime/PKGBUILD
@@ -11,7 +11,7 @@ url="https://www.cygwin.com/"
 license=('GPL')
 msys2_references=(
   'cygwin: cygwin'
-  "cpe:/a:cygwin:cygwin"
+  "cpe: cpe:/a:cygwin:cygwin"
 )
 makedepends=('cocom'
              'git'
diff --git a/msys2-w32api-headers/PKGBUILD b/msys2-w32api-headers/PKGBUILD
index 94a3a773..b8d21328 100644
--- a/msys2-w32api-headers/PKGBUILD
+++ b/msys2-w32api-headers/PKGBUILD
@@ -17,7 +17,7 @@ sha256sums=('SKIP'
             '189dd0f614caae1428e1d3a06bc3ac436d26afd9cbdbd1a7ce58b1ee6478ff3f')
 msys2_references=(
   'cygwin: w32api-runtime'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 pkgver() {
diff --git a/msys2-w32api-runtime/PKGBUILD b/msys2-w32api-runtime/PKGBUILD
index 5dc9f1a3..085a7b29 100644
--- a/msys2-w32api-runtime/PKGBUILD
+++ b/msys2-w32api-runtime/PKGBUILD
@@ -15,7 +15,7 @@ source=('mingw-w64'::"git+https://git.code.sf.net/p/mingw-w64/mingw-w64#commit=$
 sha256sums=('SKIP')
 msys2_references=(
   'cygwin: w32api-runtime'
-  'cpe:/a:mingw-w64:mingw-w64'
+  'cpe: cpe:/a:mingw-w64:mingw-w64'
 )
 
 pkgver() {
diff --git a/mutt/PKGBUILD b/mutt/PKGBUILD
index e6f5bb17..67e7766e 100644
--- a/mutt/PKGBUILD
+++ b/mutt/PKGBUILD
@@ -6,7 +6,7 @@ pkgrel=1
 pkgdesc='Small but very powerful text-based mail client (net-utils)'
 url='http://www.mutt.org/'
 msys2_references=(
-  'cpe:/a:mutt:mutt'
+  'cpe: cpe:/a:mutt:mutt'
 )
 license=('GPL')
 groups=('net-utils')
diff --git a/nano/PKGBUILD b/nano/PKGBUILD
index dbf432c4..2f864b84 100644
--- a/nano/PKGBUILD
+++ b/nano/PKGBUILD
@@ -8,7 +8,7 @@ arch=('i686' 'x86_64')
 license=('spdx:GPL-3.0-or-later')
 url="https://www.nano-editor.org"
 msys2_references=(
-  "cpe:/a:gnu:nano"
+  "cpe: cpe:/a:gnu:nano"
 )
 groups=('editors')
 depends=('file' 'libintl' 'ncurses' 'sh')
diff --git a/nasm/PKGBUILD b/nasm/PKGBUILD
index a788461f..6cbea98f 100644
--- a/nasm/PKGBUILD
+++ b/nasm/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="An 80x86 assembler designed for portability and modularity"
 arch=('i686' 'x86_64')
 url="https://www.nasm.us/"
 msys2_references=(
-  'cpe:/a:nasm:netwide_assembler'
+  'cpe: cpe:/a:nasm:netwide_assembler'
 )
 license=('spdx:BSD-2-Clause')
 makedepends=('perl-Font-TTF' 'perl-Sort-Versions' 'autotools' 'gcc')
diff --git a/ncurses/PKGBUILD b/ncurses/PKGBUILD
index ba6eb180..a229b137 100644
--- a/ncurses/PKGBUILD
+++ b/ncurses/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="System V Release 4.0 curses emulation library"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/ncurses/"
 msys2_references=(
-  "cpe:/a:gnu:ncurses"
+  "cpe: cpe:/a:gnu:ncurses"
 )
 license=('spdx:MIT')
 makedepends=('autotools' 'gcc')
diff --git a/neon/PKGBUILD b/neon/PKGBUILD
index bddad1e8..bedc3f4a 100644
--- a/neon/PKGBUILD
+++ b/neon/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="HTTP and WebDAV client library with a C interface"
 arch=('i686' 'x86_64')
 url="https://notroj.github.io/neon/"
 msys2_references=(
-  'cpe:/a:webdav:neon'
+  'cpe: cpe:/a:webdav:neon'
 )
 license=('GPL' 'LGPL')
 depends=('libexpat' 'openssl' 'ca-certificates' 'libintl')
diff --git a/nettle/PKGBUILD b/nettle/PKGBUILD
index 13d8bc8e..775d2147 100644
--- a/nettle/PKGBUILD
+++ b/nettle/PKGBUILD
@@ -7,7 +7,7 @@ pkgdesc="A low-level cryptographic library"
 arch=('i686' 'x86_64')
 url="https://www.lysator.liu.se/~nisse/nettle/"
 msys2_references=(
-  'cpe:/a:nettle_project:nettle'
+  'cpe: cpe:/a:nettle_project:nettle'
 )
 license=('spdx:GPL-2.0-or-later OR LGPL-3.0-or-later')
 groups=('net-utils')
diff --git a/nghttp2/PKGBUILD b/nghttp2/PKGBUILD
index 7448c163..c3fe8423 100644
--- a/nghttp2/PKGBUILD
+++ b/nghttp2/PKGBUILD
@@ -9,7 +9,7 @@ arch=(i686 x86_64)
 url='https://nghttp2.org/'
 msys2_repository_url="https://github.com/nghttp2/nghttp2"
 msys2_references=(
-  "cpe:/a:nghttp2:nghttp2"
+  "cpe: cpe:/a:nghttp2:nghttp2"
 )
 depends=("jansson"
          "libevent"
diff --git a/openssh/PKGBUILD b/openssh/PKGBUILD
index 1201b934..30ad46fb 100644
--- a/openssh/PKGBUILD
+++ b/openssh/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=1
 pkgdesc='Free version of the SSH connectivity tools'
 url='https://www.openssh.com/portable.html'
 msys2_changelog_url="https://www.openssh.com/releasenotes.html"
+msys2_references=(
+  "cpe: cpe:/a:openbsd:openssh"
+)
 license=('custom:BSD')
 arch=('i686' 'x86_64')
 groups=('net-utils')
diff --git a/openssl/PKGBUILD b/openssl/PKGBUILD
index bfffab05..790f2d4d 100644
--- a/openssl/PKGBUILD
+++ b/openssl/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=1
 pkgdesc='The Open Source toolkit for Secure Sockets Layer and Transport Layer Security'
 arch=('i686' 'x86_64')
 url='https://www.openssl.org'
+msys2_references=(
+  "cpe: cpe:/a:openssl:openssl"
+)
 license=('spdx:Apache-2.0')
 makedepends=('gcc' 'tar' 'perl' 'diffutils' 'nasm')
 noextract=(${pkgname}-${pkgver}.tar.gz)
diff --git a/p11-kit/PKGBUILD b/p11-kit/PKGBUILD
index 56279bf2..7504f1d9 100644
--- a/p11-kit/PKGBUILD
+++ b/p11-kit/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Library to work with PKCS#11 modules"
 arch=('i686' 'x86_64')
 url="https://p11-glue.freedesktop.org/p11-kit.html"
 msys2_repository_url="https://github.com/p11-glue/p11-kit"
+msys2_references=(
+  "cpe: cpe:/a:p11-kit_project:p11-kit"
+)
 license=('BSD')
 makedepends=('bash-completion'
              'gtk-doc'
diff --git a/p7zip/PKGBUILD b/p7zip/PKGBUILD
index af824ae9..a9d01c2c 100644
--- a/p7zip/PKGBUILD
+++ b/p7zip/PKGBUILD
@@ -5,6 +5,9 @@ pkgver=17.05
 pkgrel=2
 pkgdesc='Command-line version of the 7zip compressed file archiver'
 url="https://github.com/p7zip-project/p7zip"
+msys2_references=(
+  "cpe: cpe:/a:7-zip:p7zip"
+)
 license=('LGPL' 'custom:unRAR')
 arch=('i686' 'x86_64')
 depends=('gcc-libs' 'bash')
diff --git a/pacman/PKGBUILD b/pacman/PKGBUILD
index dea61c0a..837e5b0d 100644
--- a/pacman/PKGBUILD
+++ b/pacman/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A library-based package manager with dependency support (MSYS2 port)"
 arch=('i686' 'x86_64')
 url="https://www.archlinux.org/pacman/"
 msys2_repository_url="https://github.com/msys2/msys2-pacman"
+msys2_references=(
+  "cpe: cpe:/a:pacman_project:pacman"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=('bash>=4.2.045'
          'gettext'
diff --git a/parallel/PKGBUILD b/parallel/PKGBUILD
index 87f12b3d..520e15c7 100644
--- a/parallel/PKGBUILD
+++ b/parallel/PKGBUILD
@@ -7,6 +7,9 @@ pkgrel='1'
 pkgdesc="A shell tool for executing jobs in parallel"
 arch=('any')
 url='https://www.gnu.org/software/parallel/'
+msys2_references=(
+  "cpe: cpe:/a:gnu:parallel"
+)
 license=('GPL3')
 depends=('perl')
 makedepends=('autotools')
diff --git a/pass/PKGBUILD b/pass/PKGBUILD
index 0efacc83..6a18462e 100644
--- a/pass/PKGBUILD
+++ b/pass/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=1
 pkgdesc='Stores, retrieves, generates, and synchronizes passwords securely'
 arch=('any')
 url='https://www.passwordstore.org'
+msys2_references=(
+  "cpe: cpe:/a:zx2c4:password-store"
+)
 license=('GPL2')
 depends=('bash' 'gnupg' 'tree')
 makedepends=('libqrencode-devel')
diff --git a/patch/PKGBUILD b/patch/PKGBUILD
index 6547c16a..7dfba170 100644
--- a/patch/PKGBUILD
+++ b/patch/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=2
 pkgdesc="A utility to apply patch files to original sources"
 arch=('i686' 'x86_64')
 url="https://www.gnu.org/software/patch/patch.html"
+msys2_references=(
+  "cpe: cpe:/a:gnu:patch"
+)
 license=('GPL')
 makedepends=('ed' 'gcc' 'autotools')
 optdepends=('ed: for patch -e functionality')
diff --git a/pcre/PKGBUILD b/pcre/PKGBUILD
index d53ec725..53aab191 100644
--- a/pcre/PKGBUILD
+++ b/pcre/PKGBUILD
@@ -7,6 +7,9 @@ pkgrel=4
 pkgdesc="A library that implements Perl 5-style regular expressions"
 arch=('i686' 'x86_64')
 url="https://www.pcre.org/"
+msys2_references=(
+  "cpe: cpe:/a:pcre:pcre"
+)
 license=('BSD')
 makedepends=('libreadline-devel' 'libbz2-devel' 'zlib-devel' 'autotools' 'gcc')
 source=("https://sourceforge.net/projects/pcre/files/$pkgname/$pkgver/$pkgname-$pkgver.tar.bz2"{,.sig}
diff --git a/pcre2/PKGBUILD b/pcre2/PKGBUILD
index fd8458e7..f289ae50 100644
--- a/pcre2/PKGBUILD
+++ b/pcre2/PKGBUILD
@@ -8,6 +8,9 @@ pkgdesc="A library that implements Perl 5-style regular expressions"
 arch=('i686' 'x86_64')
 url="https://www.pcre.org/"
 msys2_repository_url="https://github.com/PCRE2Project/pcre2"
+msys2_references=(
+  "cpe: cpe:/a:pcre:pcre2"
+)
 license=('BSD')
 makedepends=('libreadline-devel' 'libbz2-devel' 'zlib-devel' 'autotools' 'gcc')
 source=(https://github.com/PCRE2Project/pcre2/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.bz2{,.sig})
diff --git a/perl-ack/PKGBUILD b/perl-ack/PKGBUILD
index 0e54cdfc..576f00a4 100644
--- a/perl-ack/PKGBUILD
+++ b/perl-ack/PKGBUILD
@@ -8,6 +8,9 @@ pkgrel=1
 pkgdesc="A Perl-based grep replacement, aimed at programmers with large trees of heterogeneous source code"
 arch=('any')
 url="https://beyondgrep.com/"
+msys2_references=(
+  "cpe: cpe:/a:beyondgrep:ack"
+)
 license=('GPL' 'PerlArtistic')
 depends=('perl-File-Next')
 groups=('perl-modules')
diff --git a/perl/PKGBUILD b/perl/PKGBUILD
index 922fb0a4..cd0a1ce3 100644
--- a/perl/PKGBUILD
+++ b/perl/PKGBUILD
@@ -8,6 +8,9 @@ pkgdesc="A highly capable, feature-rich programming language"
 arch=(i686 x86_64)
 license=('GPL')
 url="https://www.perl.org/"
+msys2_references=(
+  "cpe: cpe:/a:perl:perl"
+)
 makedepends=('libdb-devel' 'libgdbm-devel' 'libxcrypt-devel' 'gcc' 'make' 'groff')
 source=(https://www.cpan.org/src/5.0/perl-${pkgver}.tar.xz
         perlbin.sh
diff --git a/pkgconf/PKGBUILD b/pkgconf/PKGBUILD
index 5deb041d..7cbe3f9e 100644
--- a/pkgconf/PKGBUILD
+++ b/pkgconf/PKGBUILD
@@ -5,6 +5,9 @@ pkgver=2.1.1
 pkgrel=1
 pkgdesc='pkg-config compatible utility which does not depend on glib'
 url='https://github.com/pkgconf/pkgconf'
+msys2_references=(
+  "cpe: cpe:/a:pkgconf:pkgconf"
+)
 arch=('i686' 'x86_64')
 license=('spdx:ISC')
 makedepends=('meson'
diff --git a/procps-ng/PKGBUILD b/procps-ng/PKGBUILD
index e838471c..7c15402f 100644
--- a/procps-ng/PKGBUILD
+++ b/procps-ng/PKGBUILD
@@ -4,6 +4,9 @@ pkgrel=1
 pkgdesc='Utilities for monitoring your system and its processes'
 arch=('i686' 'x86_64')
 url='https://gitlab.com/procps-ng/procps'
+msys2_references=(
+  "cpe: cpe:/a:procps-ng_project:procps-ng"
+)
 license=('GPL' 'LGPL')
 groups=('sys-utils')
 depends=('ncurses')
diff --git a/procps/PKGBUILD b/procps/PKGBUILD
index 551253b2..96bda8ab 100644
--- a/procps/PKGBUILD
+++ b/procps/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=3
 pkgdesc="System and process monitoring utilities"
 arch=('i686' 'x86_64')
 url="https://procps.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:procps_project:procps"
+)
 license=('GPL2')
 groups=('sys-utils')
 makedepends=('ncurses-devel' 'make' 'gcc')
diff --git a/protobuf/PKGBUILD b/protobuf/PKGBUILD
index 847b8be4..cd8e4768 100644
--- a/protobuf/PKGBUILD
+++ b/protobuf/PKGBUILD
@@ -8,6 +8,9 @@ pkgdesc="Protocol Buffers - Google's data interchange format"
 arch=('i686' 'x86_64')
 url='https://developers.google.com/protocol-buffers/'
 msys2_repository_url="https://github.com/protocolbuffers/protobuf"
+msys2_references=(
+  "cpe: cpe:/a:google:protobuf"
+)
 groups=('libraries')
 license=('spdx:BSD-3-Clause')
 depends=('gcc-libs' 'zlib')
diff --git a/pwgen/PKGBUILD b/pwgen/PKGBUILD
index 4690616f..c51f2d4d 100644
--- a/pwgen/PKGBUILD
+++ b/pwgen/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=2
 pkgdesc='Password generator for creating easily memorable passwords'
 arch=('x86_64' 'i686')
 url='https://sourceforge.net/projects/pwgen/'
+msys2_references=(
+  "cpe: cpe:/a:pwgen_project:pwgen"
+)
 license=('GPL')
 makedepends=('autotools' 'gcc')
 source=("https://downloads.sourceforge.net/sourceforge/pwgen/$pkgname-$pkgver.tar.gz")
diff --git a/python/PKGBUILD b/python/PKGBUILD
index 853eaa6b..4793cae1 100644
--- a/python/PKGBUILD
+++ b/python/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Next generation of the python high-level scripting language"
 arch=('i686' 'x86_64')
 license=('custom')
 url="https://www.python.org/"
+msys2_references=(
+  "cpe: cpe:/a:python:python"
+)
 makedepends=(
   'libbz2-devel'
   'libxcrypt-devel'
diff --git a/re2c/PKGBUILD b/re2c/PKGBUILD
index aaf39305..a649e300 100644
--- a/re2c/PKGBUILD
+++ b/re2c/PKGBUILD
@@ -8,6 +8,9 @@ arch=('i686' 'x86_64')
 pkgdesc='A tool for generating C-based recognizers from regular expressions'
 url='https://re2c.org/'
 msys2_repository_url="https://github.com/skvadrik/re2c"
+msys2_references=(
+  "cpe: cpe:/a:re2c:re2c"
+)
 license=('public domain')
 depends=('gcc-libs')
 makedepends=('cmake' 'gcc' 'python')
diff --git a/readline/PKGBUILD b/readline/PKGBUILD
index 4b85c2e2..a2fab1dc 100644
--- a/readline/PKGBUILD
+++ b/readline/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="GNU readline library"
 arch=('i686' 'x86_64')
 url="https://tiswww.case.edu/php/chet/readline/rltop.html"
 msys2_repository_url="https://git.savannah.gnu.org/cgit/readline.git"
+msys2_references=(
+  "cpe: cpe:/a:gnu:readline"
+)
 license=('GPL')
 makedepends=('ncurses-devel' 'autotools' 'gcc')
 options=('!emptydirs')
diff --git a/rsync/PKGBUILD b/rsync/PKGBUILD
index 65e60a58..cc606753 100644
--- a/rsync/PKGBUILD
+++ b/rsync/PKGBUILD
@@ -6,6 +6,9 @@ pkgrel=2
 pkgdesc="A file transfer program to keep remote files in sync"
 arch=('i686' 'x86_64')
 url="https://rsync.samba.org"
+msys2_references=(
+  "cpe: cpe:/a:samba:rsync"
+)
 groups=('net-utils')
 license=('GPL3')
 depends=('perl' 'libiconv' 'liblz4' 'libopenssl' 'libxxhash' 'libzstd')
diff --git a/ruby/PKGBUILD b/ruby/PKGBUILD
index d7bbc7bc..14cf91fb 100644
--- a/ruby/PKGBUILD
+++ b/ruby/PKGBUILD
@@ -5,6 +5,9 @@ pkgver=3.3.0
 pkgrel=1
 arch=('i686' 'x86_64')
 url='https://www.ruby-lang.org/en/'
+msys2_references=(
+  "cpe: cpe:/a:ruby-lang:ruby"
+)
 license=('BSD' 'custom')
 makedepends=('openssl-devel' 'libffi-devel' 'doxygen' 'libxcrypt-devel'  'gmp-devel' 'libyaml-devel' 'libgdbm-devel' 'libiconv-devel' 'libreadline-devel' 'zlib-devel' 'autotools' 'gcc')
 source=(https://cache.ruby-lang.org/pub/ruby/${pkgver%.*}/ruby-${pkgver//_/-}.tar.xz
diff --git a/serf/PKGBUILD b/serf/PKGBUILD
index abe71ec5..9d26cc0d 100644
--- a/serf/PKGBUILD
+++ b/serf/PKGBUILD
@@ -7,6 +7,9 @@ pkgrel=8
 pkgdesc="High-performance asynchronous HTTP client library"
 arch=('i686' 'x86_64')
 url="https://serf.apache.org/"
+msys2_references=(
+  "cpe: cpe:/a:serf_project:serf"
+)
 license=('Apache')
 makedepends=('scons' 'apr-util-devel' 'heimdal-devel' 'zlib-devel' 'openssl-devel' 'libiconv-devel' 'gcc')
 source=(https://archive.apache.org/dist/serf/${pkgbase}-${pkgver}.tar.bz2
diff --git a/sharutils/PKGBUILD b/sharutils/PKGBUILD
index e6f50401..55750d36 100644
--- a/sharutils/PKGBUILD
+++ b/sharutils/PKGBUILD
@@ -3,6 +3,9 @@
 pkgname='sharutils'
 pkgdesc='Makes so-called shell archives out of many files'
 url='https://www.gnu.org/software/sharutils'
+msys2_references=(
+  "cpe: cpe:/a:gnu:sharutils"
+)
 license=(GPL3+)
 arch=(i686 x86_64)
 pkgver=4.15.2
diff --git a/socat/PKGBUILD b/socat/PKGBUILD
index a5a7fac9..ca4ac7b1 100644
--- a/socat/PKGBUILD
+++ b/socat/PKGBUILD
@@ -8,6 +8,9 @@ pkgver=1.7.4.4
 pkgrel=2
 pkgdesc='Multipurpose relay'
 url='http://www.dest-unreach.org/socat/'
+msys2_references=(
+  "cpe: cpe:/a:dest-unreach:socat"
+)
 license=('GPL2')
 arch=('i686' 'x86_64')
 depends=('libreadline' 'libopenssl')