1 files changed, 17 insertions, 2 deletions

diff --git a/.oelint.cfg b/.oelint.cfg
index fbf1ede14..37c94ca3c 100644
--- a/.oelint.cfg
+++ b/.oelint.cfg
@@ -2,8 +2,23 @@
 # directory as the working directory (see contrib/oelint/run-oelint.sh).
 #
 # Layer-specific parser hints live in oelint.constants.json and are passed by
-# contrib/oelint/run-oelint.sh. Rule exceptions should stay inline as
+# contrib/oelint/run-oelint.sh. Per-recipe exceptions should stay inline as
 # '# nooelint: <rule.id>' comments next to the finding, so new recipes are fully
-# linted and each exception is documented in place.
+# linted and each exception is documented in place. Only rules that provably
+# never apply to the whole layer are suppressed here:
+#
+#   * oelint.var.bbclassextend - meta-freescale is a BSP layer; the bulk of its
+#     recipes package machine-specific firmware and prebuilt binaries that are
+#     not cross-compilable libraries, so BBCLASSEXTEND (native/nativesdk) does
+#     not apply.
+#   * oelint.var.suggestedvar.CVE_PRODUCT / .BUGTRACKER - advisory 'suggested'
+#     variables. Most recipes here package NXP firmware/BSP components with no
+#     upstream bug tracker and no meaningful NVD CPE product; guessing a
+#     CVE_PRODUCT would create false or missed CVE matches, which is worse than
+#     leaving it unset. Set them inline on the rare recipe that has a real value.
 [oelint]
 release = wrynose
+suppress =
+    oelint.var.bbclassextend
+    oelint.var.suggestedvar.CVE_PRODUCT
+    oelint.var.suggestedvar.BUGTRACKER