linux/poky.git/meta/classes/cve-check.bbclass, branch scarthgap

meta/classes: fix missing vardeps for CVE status variables

2026-02-16T09:52:35+00:00

Several CVE helper functions (get_patched_cves() and decode_cve_status()) implicitly depend on the CVE_STATUS and CVE_CHECK_STATUSMAP variables, but these were not declared in the vardeps of their callers. On Scarthgap, the upstream fix (2cc43c72ff28aa39a417dd8d57cd7c8741c0e541) cannot be cherry-picked cleanly, as it also requires BitBake changes. As a workaround, explicitly add CVE_STATUS and CVE_CHECK_STATUSMAP to the vardeps of all tasks invoking these helpers, ensuring correct task re-execution when CVE status changes. This keeps CVE-related metadata generation consistent without requiring BitBake modifications. (From OE-Core rev: 111e1f2febade3c34649f33676f7f7e7cc8e0bd0) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

cve-check: extract extending CVE_STATUS to library function

2025-12-01T15:34:55+00:00

The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman

cve-check: Add missing call to exit_if_errors

2025-08-22T12:59:54+00:00

check_cves may raise the cve_status_not_in_db QA check. Call exit_if_errors to make sure that the task is marked as failed when the check is categorized as an error. cve_status_not_in_db was in the meantime dropped in OE-Core 452e605b55ad61c08f4af7089a5a9c576ca28f7d so this change is only required on scarthgap. (From OE-Core rev: b3d12589c26f4e86b153bbdcda774985e4e046bd) Signed-off-by: Philip Lorenz Signed-off-by: Steve Sakoman

cve-check.bbclass: Fix symlink handling also for text files

2025-05-19T15:32:49+00:00

While backporting commit 7543e4e24a8b ("cve-check.bbclass: Mitigate symlink related error") I failed to address the fact that in Scarthgap this bbclass still generates also the text CVE file, in addition to the JSON file. In order to avoid the error that occurred with JSON files from occurring now with CVE files: ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.cve (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. update the symlink handling for the text file variant too. (From OE-Core rev: 81e702c85c62782dbedd5ca2a5e6569e6339dd60) Signed-off-by: Niko Mauno Signed-off-by: Steve Sakoman

cve-check.bbclass: Mitigate symlink related error

2025-03-15T13:40:08+00:00

According to Yocto reference manual, in description of the IMAGE_LINK_NAME variable, it is said that It is possible to set this to "" to disable symlink creation, however, you also need to set :term:`IMAGE_NAME` to still have a reasonable value e.g.:: IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" However, when using following additions in local.conf file: INHERIT += "cve-check" IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" the implicit symlink creation in cve_check_write_rootfs_manifest leads to following build failure $ bitbake core-image-minimal core-image-base ... ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.json (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME has not been set to empty string. (From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1) (From OE-Core rev: 35e210e3ebe21f1f4466760076b7140618af536e) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

cve_check: Use a local copy of the database during builds

2024-11-09T13:53:57+00:00

Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from a local copy in STAGING DIR after fetching. (From OE-Core rev: 57de6545695ac11816d670959d9e63666de08e3d) Signed-off-by: Richard Purdie (cherry picked from commit 03596904392d257572a905a182b92c780d636744) Signed-off-by: Steve Sakoman

cve-check: add support for cvss v4.0

2024-11-09T13:53:57+00:00

https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) (From OE-Core rev: 290407b3785bce2d22212a7ab9d3a349c8935cc0) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

cve-check: Introduce CVE_CHECK_MANIFEST_JSON_SUFFIX

2024-08-01T13:08:09+00:00

The variable contains the suffix of the CVE JSON manifest file. By default, this variable is set to 'json', so the current behavior is not changed, but enables developers to use some other suffix, e.g., cve.json (similar to spdx.json). (From OE-Core rev: 0cb103430d0505a3cd135e727379489bc3fe6e46) Signed-off-by: Aleksandar Nikolic Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit d99eee76923659c0b95bf9ef415ae5d44f736d01) Signed-off-by: Steve Sakoman

cve-check: Log if CVE_STATUS set but not reported for component

2024-02-24T16:10:23+00:00

Log if the CVE_STATUS is set for a CVE, but the cve is not reported for a component. This should hopefully help to clean up not needed CVE_STATUS settings. (From OE-Core rev: 013d531a84fa08b6ae8a47bdf3ba1fa8f18ba270) Signed-off-by: Simone Weiß Signed-off-by: Richard Purdie

Revert "cve-check: Modify judgment processing using "=" in version comparison"

2023-12-05T21:16:43+00:00

This change introduced a warning if version comparisons failed, but this is far too common an issue in data that we don't control, so this shouldn't cause a warning: WARNING: automake-native-1.16.5-r0 do_cve_check: automake: Failed to compare 1.16.5 = branch_1-9 for CVE-2009-4029 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2010-4539 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2010-4539 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2010-4539 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2010-4539 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2010-4644 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2010-4644 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2010-4644 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2010-4644 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m1 for CVE-2011-0715 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m2 for CVE-2011-0715 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m3 for CVE-2011-0715 WARNING: subversion-1.14.2-r0 do_cve_check: subversion: Failed to compare 1.14.2 = m4\/m5 for CVE-2011-0715 WARNING: automake-1.16.5-r0 do_cve_check: automake: Failed to compare 1.16.5 = branch_1-9 for CVE-2009-4029 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2003-0577 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2004-0982 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2004-1284 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2006-3355 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2007-0578 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2007-0578 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s for CVE-2009-1301 WARNING: mpg123-1.32.3-r0 do_cve_check: mpg123: Failed to compare 1.32.3 = pre0.59s_r11 for CVE-2009-1301 This reverts commit a1989e4197178c2431ceca499e0b4876b233b131. (From OE-Core rev: c7c7dbdd5474002cfd9ec24864e77a0df2b790ea) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie