linux/poky.git/meta/classes/cve-check.bbclass, branch master-test

cve-check: show real PN/PV

2020-11-24T10:27:45+00:00

The output currently shows the remapped product and version fields, which may not be the actual recipe name/version. As this report is about recipes, use the real values. (From OE-Core rev: 18827d7f40db4a4f92680bd59ca655cca373ad65) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: add CVE_CHECK_REPORT_PATCHED variable to suppress reporting of patched CVEs

2020-09-30T14:01:51+00:00

Default behavior is not changed. To suppress patched CVEs, set: CVE_CHECK_REPORT_PATCHED = "" (From OE-Core rev: 05bd9f1f006cf94cf5324f96df29cd5862abaf45) Signed-off-by: Chris Laplante Signed-off-by: Richard Purdie

cve-check: introduce CVE_CHECK_RECIPE_FILE variable to allow changing of per-recipe check file

2020-09-30T14:01:51+00:00

The addition of this variable also makes it possible to change the output suffix of the check files, e.g. in local.conf: CVE_CHECK_MANIFEST_append = ".txt" CVE_CHECK_RECIPE_FILE_append = ".txt" (From OE-Core rev: 0d40f1482c6d87785ae47c46c2305e1df46f459a) Signed-off-by: Chris Laplante Signed-off-by: Richard Purdie

cve-update-db-native: use fetch task

2020-09-12T13:49:00+00:00

Instead of inventing a new task to fetch the CVE data, use the existing fetch task. (From OE-Core rev: f5f97d33a1703d75b9fd9760f2c7767081538e00) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: avoid FileNotFoundError if no do_cve_check task has run

2020-09-10T12:48:26+00:00

For example, if you just run 'bitbake cve-update-db-native' in a clean build system, |cve_tmp_file| won't exist yet. (From OE-Core rev: dd4473f3d8e1c1a587b6de660775e4b46ddc5fad) Signed-off-by: Chris Laplante Signed-off-by: Richard Purdie

cve-check/cve-update-db-native: use lockfile to fix usage under multiconfig

2020-09-10T12:48:26+00:00

Previously CVE_CHECK_DB_FILE / CVE_CHECK_DB_DIR was the same across multiconfigs which led to a race condition wherein multiple cve-update-db-native:do_populate_cve_db tasks could attempt to write to the same sqlite database. This led to the following task failure: Error executing a python function in exec_python_func() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_python_func() autogenerated', lineno: 2, function: 0001: *** 0002:do_populate_cve_db(d) 0003: File: '/mnt/data/agent/work/74f119cccb44f133/yocto/sources/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 103, function: do_populate_cve_db 0099: if year == date.today().year: 0100: cve_f.write('CVE database update : %s\n\n' % date.today()) 0101: 0102: cve_f.close() *** 0103: conn.commit() 0104: conn.close() 0105:} 0106: 0107:def initialize_db(c): Exception: sqlite3.OperationalError: disk I/O error Use a lockfile to ensure multiple tasks don't step over each other. (From OE-Core rev: 24e9380643a2ae3fcae193519cb64aedaf682153) Signed-off-by: Chris Laplante Signed-off-by: Richard Purdie

cve-check.bbclass: always save cve report

2020-07-18T10:06:31+00:00

The cve-check file should be saved always, it has good info. Put a copy in the log dir as cve-summary with symlinks to latest run. [Yocto #13974] (From OE-Core rev: 859849c7b594d844819ad8c3f7d8325388d94b93) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

cve-check: include epoch in product version output

2020-06-04T12:27:31+00:00

In the generated cve.log files, include the epoch in the product version. This better matches how versions are displayed elsewhere, in particular the bb.warn("Found unpatched CVE...") that appears on the terminal when CVEs are found. (From OE-Core rev: e1c3c0b6e5b01304e2127f5058986697e82adf93) Signed-off-by: Ralph Siemsen Signed-off-by: Richard Purdie

cve-check: Run it after do_fetch

2020-05-24T22:56:03+00:00

Certain recipes e.g. bash readline ( from meta-gplv2 ) download patches instead of having them in metadata, this could fail cve_check ERROR: readline-5.2-r9 do_cve_check: File Not found: qemuarm/build/../downloads/readline52-001 This patch ensures that download is done before running CVE scan, even though these will be external patches and may not contain CVE tags as it expects, but it will fix the run failures as seen above (From OE-Core rev: e406fcb6c609a0d2456d7da0d2406d2d9fa52dd2) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

cve-check: CPE version '-' as all version

2020-04-01T10:44:23+00:00

CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie