linux/poky.git/meta/classes/cve-check.bbclass, branch mickledore

cve-check: sort the package list in the JSON report

2023-11-11T18:23:01+00:00

The JSON report generated by the cve-check class is basically a huge list of packages. This list of packages is, however, unsorted. To make things easier for people comparing the JSON, or more specifically for git when archiving the JSON over time in a git repository, we can sort the list by package name. (From OE-Core rev: e32b4655e79561dd9c38efdf99858372bde806b0) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit e9861be0e5020830c2ecc24fd091f4f5b05da036) Signed-off-by: Steve Sakoman

cve-check: add CVSS vector string to CVE database and reports

2023-10-25T14:51:01+00:00

This allows building detailed vulnerability analysis tools without relying on external resources. (From OE-Core rev: 587ae7bc85fc471d927308d866821d463799023d) Signed-off-by: Antoine Lubineau Signed-off-by: Alexandre Belloni (cherry picked from commit 048ff0ad927f4d37cc5547ebeba9e0c221687ea6) Signed-off-by: Steve Sakoman

cve-update-nvd2-native: new CVE database fetcher

2023-04-01T10:36:26+00:00

Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities (From OE-Core rev: fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: Fix false negative version issue

2023-03-30T11:30:38+00:00

NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL (From OE-Core rev: 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Geoffrey GIRY Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: write the cve manifest to IMGDEPLOYDIR

2023-01-18T16:42:28+00:00

When building an image cve_check_write_rootfs_manifest() would sometimes fail with a FileNotFoundError when writing the manifest.cve due to the parent directory (DEPLOY_DIR_IMAGE) not (yet) existing. The image task will provide the manifest in the deploy directory afterwards, so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should continue to function properly. (From OE-Core rev: 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483) Signed-off-by: Jermain Horsman Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

cve-check: close cursors as soon as possible

2022-09-02T14:58:25+00:00

We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

classes: cve-check: Get shared database lock

2022-08-31T09:40:07+00:00

The CVE check database needs to have a shared lock acquired on it before it is accessed. This to prevent cve-update-db-native from deleting the database file out from underneath it. [YOCTO #14899] (From OE-Core rev: 20a9911b73df62a0d0d1884e57085f13ac5016dd) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes: Add SPDX license identifiers

2022-08-12T10:58:01+00:00

As stated in our top level license files, the license is MIT unless otherwise stated. Add SPDX identifers accordingly. Replace older license statementa with the standardised syntax. Also drop "All Rights Reserved" expression as it isn't used now, doesn't mean anything and is confusing. (From OE-Core rev: 081a391fe09a21265881e39a2a496e4e10b4f80b) Signed-off-by: Richard Purdie

classes: Add copyright statements to files without one

2022-08-12T10:58:01+00:00

Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie

cve-check: hook cleanup to the BuildCompleted event, not CookerExit

2022-06-30T09:27:17+00:00

The cve-check class writes temporary files to preserve state across the build, and cleans them up in a CookerExit handler. However, in memory-resident builds the cooker won't exit in between builds, so the state isn't cleared and the CVE report generation fails: NOTE: Generating JSON CVE summary ERROR: Error adding the same package twice Easily solved by hooking to BuildCompleted, instead of CookerExit. (From OE-Core rev: fccdcfd301de281a427bfee48d8ff47fa07b7259) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie