oelint: Suppress advisory CVE_PRODUCT and BUGTRACKER layer-wideoelint-cleanup-4-config-suppress

oelint.var.suggestedvar.CVE_PRODUCT (179 findings) and
oelint.var.suggestedvar.BUGTRACKER (191 findings) are advisory
"suggested" variables. The overwhelming majority of recipes in this
layer package NXP firmware and BSP components that have no upstream bug
tracker and no meaningful NVD CPE product.

Filling CVE_PRODUCT with a guessed product string is actively harmful:
it makes cve-check match the wrong CPE, producing false positives and
masking real advisories. Leaving it unset is the correct default.

Suppress both layer-wide rather than annotating hundreds of recipes.
The rare recipe that does have a real value can still set it inline.

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>

1 files changed, 13 insertions, 5 deletions

diff --git a/.oelint.cfg b/.oelint.cfg
index 7729602f7..37c94ca3c 100644
--- a/.oelint.cfg
+++ b/.oelint.cfg
@@ -5,12 +5,20 @@
 # contrib/oelint/run-oelint.sh. Per-recipe exceptions should stay inline as
 # '# nooelint: <rule.id>' comments next to the finding, so new recipes are fully
 # linted and each exception is documented in place. Only rules that provably
-# never apply to the whole layer are suppressed here.
+# never apply to the whole layer are suppressed here:
+#
+#   * oelint.var.bbclassextend - meta-freescale is a BSP layer; the bulk of its
+#     recipes package machine-specific firmware and prebuilt binaries that are
+#     not cross-compilable libraries, so BBCLASSEXTEND (native/nativesdk) does
+#     not apply.
+#   * oelint.var.suggestedvar.CVE_PRODUCT / .BUGTRACKER - advisory 'suggested'
+#     variables. Most recipes here package NXP firmware/BSP components with no
+#     upstream bug tracker and no meaningful NVD CPE product; guessing a
+#     CVE_PRODUCT would create false or missed CVE matches, which is worse than
+#     leaving it unset. Set them inline on the rare recipe that has a real value.
 [oelint]
 release = wrynose
-# meta-freescale is a BSP layer: the bulk of its recipes package machine-specific
-# firmware and prebuilt binaries that are not cross-compilable libraries, so
-# BBCLASSEXTEND (native/nativesdk) does not apply. Suppress it layer-wide rather
-# than annotating every such recipe.
 suppress =
     oelint.var.bbclassextend
+    oelint.var.suggestedvar.CVE_PRODUCT
+    oelint.var.suggestedvar.BUGTRACKER