linux/poky.git/meta/classes/cve-check.bbclass, branch master-uninative

cve-check: add coverage statistics on recipes with/without CVEs

2022-03-30T12:07:41+00:00

Until now the CVE checker was giving information about CVEs found for a product (or more products) contained in a recipe. However, there was no easy way to find out which products or recipes have no CVEs. Having no reported CVEs might mean there are simply none, but can also mean a product name (CPE) mismatch. This patch adds CVE_CHECK_COVERAGE option enabling a new type of statistics. Then we use the new JSON format to report the information. The legacy text mode report does not contain it. This option is expected to help with an identification of recipes with mismatched CPEs, issues in the database and more. This work is based on [1], but adding the JSON format makes it easier to implement, without additional result files. [1] https://lists.openembedded.org/g/openembedded-core/message/159873 (From OE-Core rev: d1849a1facd64fa0bcf8336a0ed5fbf71b2e3cb5) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: add json format

2022-03-30T12:07:41+00:00

Add an option to output the CVE check in a JSON-based format. This format is easier to parse in software than the original text-based one and allows post-processing by other tools. Output formats are now handed by CVE_CHECK_FORMAT_TEXT and CVE_CHECK_FORMAT_JSON. Both of them are enabled by default. The JSON output format gets generated in a similar way to the text format with the exception of the manifest: appending to JSON arrays requires parsing the file. Because of that we first write JSON fragments and then assemble them in one pass at the end. (From OE-Core rev: df567de36ae5964bee433ebb97e8bf702034994a) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

meta/scripts: Improve internal variable naming

2022-03-10T08:00:28+00:00

Update internal variable names to improve the terms used. (From OE-Core rev: f408068e5d7998ae165f3002e51bc54b380b8099) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

Revert "cve-check: add lockfile to task"

2022-02-27T12:34:40+00:00

Now that all of the functions in cve-check open the database read-only, we can remove this lockfile. This means cve-check can run in parallal again, improving runtimes massively. This reverts commit d55fbf4779483d2cfd71df78d0f733b599fef739. (From OE-Core rev: d3d3e7b324698ec3e6fce1951aba389805f3edd3) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: get_cve_info should open the database read-only

2022-02-25T12:41:23+00:00

All of the function in cve-check should open the database read-only, as the only writer is the fetch task in cve-update-db. However, get_cve_info() was failing to do this, which might be causing locking issues with sqlite. (From OE-Core rev: 8de517238f1f418d9af1ce312d99de04ce2e26fc) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

meta/scripts: Automated conversion of OE renamed variables

2022-02-21T23:37:27+00:00

(From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81) Signed-off-by: Richard Purdie

cve-check: create directory of CVE_CHECK_MANIFEST before copy

2022-02-07T10:08:59+00:00

Create directory of the CVE_CHECK_MANIFEST variable before copy to it, so that the variable can use an arbitrary directory name. (From OE-Core rev: 9829c16301bf2dce39fa046401a984f112fa0322) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie

cve-check: add lockfile to task

2022-01-08T14:17:35+00:00

this should prevent running into the very rare error sqlite3.OperationalError: attempt to write a readonly database As highlighted by https://www.sqlite.org/faq.html#q5 it is likely that the adapter won't allow use multiple exec calls at the same time. So it's best to prevent multiple accesses at a time, by reusing the already in place CVE_CHECK_DB_FILE_LOCK YOCTO #14110 (From OE-Core rev: 677f5741bd265be49d4a5bb933b3e8d8c4eec653) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie

classes/cve-check: Move get_patches_cves to library

2021-08-13T13:44:06+00:00

Moving the function will allow other classes to capture which CVEs have been patched, in particular SBoM generation. Also add a function to capture the CPE ID from the CVE Product and Version (From OE-Core rev: 75d34259a715120be1d023e4fd7b6b4b125f2443) Signed-off-by: Joshua Watt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: remove deprecated CVE_CHECK_CVE_WHITELIST

2021-08-12T05:26:15+00:00

This variable has been deprecated since Yocto Project version 3.0. (From OE-Core rev: f8ac58568b2dceef54a743369460019b3a3eeccd) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie