linux/poky.git/meta/classes/cve-check.bbclass, branch mickledore-4.2.3

cve-update-nvd2-native: new CVE database fetcher

2023-04-01T10:36:26+00:00

Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities (From OE-Core rev: fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: Fix false negative version issue

2023-03-30T11:30:38+00:00

NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL (From OE-Core rev: 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Geoffrey GIRY Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: write the cve manifest to IMGDEPLOYDIR

2023-01-18T16:42:28+00:00

When building an image cve_check_write_rootfs_manifest() would sometimes fail with a FileNotFoundError when writing the manifest.cve due to the parent directory (DEPLOY_DIR_IMAGE) not (yet) existing. The image task will provide the manifest in the deploy directory afterwards, so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should continue to function properly. (From OE-Core rev: 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483) Signed-off-by: Jermain Horsman Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

cve-check: close cursors as soon as possible

2022-09-02T14:58:25+00:00

We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

classes: cve-check: Get shared database lock

2022-08-31T09:40:07+00:00

The CVE check database needs to have a shared lock acquired on it before it is accessed. This to prevent cve-update-db-native from deleting the database file out from underneath it. [YOCTO #14899] (From OE-Core rev: 20a9911b73df62a0d0d1884e57085f13ac5016dd) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes: Add SPDX license identifiers

2022-08-12T10:58:01+00:00

As stated in our top level license files, the license is MIT unless otherwise stated. Add SPDX identifers accordingly. Replace older license statementa with the standardised syntax. Also drop "All Rights Reserved" expression as it isn't used now, doesn't mean anything and is confusing. (From OE-Core rev: 081a391fe09a21265881e39a2a496e4e10b4f80b) Signed-off-by: Richard Purdie

classes: Add copyright statements to files without one

2022-08-12T10:58:01+00:00

Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie

cve-check: hook cleanup to the BuildCompleted event, not CookerExit

2022-06-30T09:27:17+00:00

The cve-check class writes temporary files to preserve state across the build, and cleans them up in a CookerExit handler. However, in memory-resident builds the cooker won't exit in between builds, so the state isn't cleared and the CVE report generation fails: NOTE: Generating JSON CVE summary ERROR: Error adding the same package twice Easily solved by hooking to BuildCompleted, instead of CookerExit. (From OE-Core rev: fccdcfd301de281a427bfee48d8ff47fa07b7259) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: add support for Ignored CVEs

2022-06-17T16:57:44+00:00

Ignored CVEs aren't patched, but do not apply in our configuration for some reason. Up till now they were only partially supported and reported as "Patched". This patch adds separate reporting of Ignored CVEs. The variable CVE_CHECK_REPORT_PATCHED now manages reporting of both patched and ignored CVEs. (From OE-Core rev: c773102d4828fc4ddd1024f6115d577e23f1afe4) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: fix return type in check_cves

2022-06-06T12:36:05+00:00

Make empty return types in check_cvs the same for all code paths. (From OE-Core rev: f86393c93dec47b24e837d0c4c5761a716ecdbb6) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie