linux/poky.git/meta/classes/cve-check.bbclass, branch hardknott

cve-check: create directory of CVE_CHECK_MANIFEST before copy

2022-02-20T15:32:27+00:00

Create directory of the CVE_CHECK_MANIFEST variable before copy to it, so that the variable can use an arbitrary directory name. (From OE-Core rev: 113b21fd3edc599c280f34875ca1477606424eec) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie (cherry picked from commit 9829c16301bf2dce39fa046401a984f112fa0322) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: add lockfile to task

2022-01-25T12:07:01+00:00

this should prevent running into the very rare error sqlite3.OperationalError: attempt to write a readonly database As highlighted by https://www.sqlite.org/faq.html#q5 it is likely that the adapter won't allow use multiple exec calls at the same time. So it's best to prevent multiple accesses at a time, by reusing the already in place CVE_CHECK_DB_FILE_LOCK YOCTO #14110 (From OE-Core rev: 155c238d340fdc82420ba9f367cb23014c78b705) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie (cherry picked from commit 677f5741bd265be49d4a5bb933b3e8d8c4eec653) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: improve comment about CVE patch file names

2021-08-14T11:01:44+00:00

(From OE-Core rev: fea9f2edf515cca07e867213294d0e6dafbfbd74) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie (cherry picked from commit 8aa613480663e11ecc62278d8c57ca719eb23899) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: update link to NVD website for CVE details

2021-08-14T11:01:44+00:00

The old URL schema https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-ID now redirects to https://nvd.nist.gov/vuln/detail/CVE-ID (From OE-Core rev: 7dfaadfbdc5f5e6dd96fadb092314ab9d05674fd) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie (cherry picked from commit 57adb57a9d9b08c08ab606ec7b561792e4f4ff2d) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: fix comments

2021-08-14T11:01:44+00:00

This implements various fixes in comments in cve-check.bbclass In particular, the "whitlisted" typo is important as the "whitelisted" word is going to be replaced in a near future. (From OE-Core rev: 80941c3ae3c2ee8ca48462f20ef5187b26a35247) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie (cherry picked from commit 5eecd2bf942254d08c252388594e5ec7ae330f45) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: add include/exclude layers

2021-02-09T08:56:10+00:00

There are times when exluding or including a layer may be desired. This provide the framwork for that via two variables. The default is all layers in bblayers. CVE_CHECK_LAYER_INCLUDELIST CVE_CHECK_LAYER_EXCLUDELIST (From OE-Core rev: 5fdde65ef58b4c1048839e4f9462b34bab36fc22) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

cve-check.bbclass: add layer to cve log

2021-02-09T08:56:10+00:00

Lets include whcih layer a package belongs to and add it to the cve logs (From OE-Core rev: 00d965bb42dc427749a4c3985af56ceffff80457) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

cve_check: add CVE_VERSION_SUFFIX to indicate suffix in versioning

2021-01-30T10:41:04+00:00

add CVE_VERSION_SUFFIX to indicate the version suffix type, currently works in two value, "alphabetical" if the version string uses single alphabetical character suffix as incremental release, blank to not consider the unidentified suffixes. This can be expand when more suffix pattern identified. refactor cve_check.Version class to use functools and add parameter to handle suffix condition. Also update testcases to cover new changes. (From OE-Core rev: 5dfd5ad5144708b474ef31eaa89a846c57be8ac0) Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie

cve-check: replace Looseversion with custom version class

2021-01-23T17:08:54+00:00

The way distutils.version.LooseVersion compare version are tricky, it treat all these ( "1.0-beta2", "1.0-rc1", "1.0A", "1.0p2" and "1.0pre1") as greater version than "1.0". This might be right for "1.0A" and "1.0p1" but not for the rest, also these version could be confusing, the "p" in "1.0p1" can be "pre" or "patched" version or even other meaning. Replace Looseversion with custom class, it uses regex to capture common version format like "1.1.1" or tag format using date like "2020-12-12" as release section, check for following known string/tags ( beta, rc, pre, dev, alpha, preview) as pre-release section, any other trailing characters are difficult to understand/define so ignore them. Compare release section and pre-release section saperately. included selftest for the version class. [YOCTO#14127] (From OE-Core rev: 6ced85e9ddd3569240f1e8b82130d1ac0fffbc40) Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie

cve-check: show real PN/PV

2020-11-24T10:27:45+00:00

The output currently shows the remapped product and version fields, which may not be the actual recipe name/version. As this report is about recipes, use the real values. (From OE-Core rev: 18827d7f40db4a4f92680bd59ca655cca373ad65) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie