linux/poky.git/meta/classes/cve-check.bbclass, branch yocto-3.1.19

classes/cve-check: Move get_patches_cves to library

2022-07-16T05:52:48+00:00

Moving the function will allow other classes to capture which CVEs have been patched, in particular SBoM generation. Also add a function to capture the CPE ID from the CVE Product and Version (From OE-Core rev: 75d34259a715120be1d023e4fd7b6b4b125f2443) (From OE-Core rev: bba069463ca3813666d084643b0239b9af0199e1) Signed-off-by: Joshua Watt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit fa6c07bc1a585f204dbdc28704f61448edb8fdc8) Signed-off-by: Akash Hadke Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: hook cleanup to the BuildCompleted event, not CookerExit

2022-07-15T11:29:17+00:00

The cve-check class writes temporary files to preserve state across the build, and cleans them up in a CookerExit handler. However, in memory-resident builds the cooker won't exit in between builds, so the state isn't cleared and the CVE report generation fails: NOTE: Generating JSON CVE summary ERROR: Error adding the same package twice Easily solved by hooking to BuildCompleted, instead of CookerExit. (From OE-Core rev: ee3270709158aff463fec6798f3b8968268b4d4b) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit fccdcfd301de281a427bfee48d8ff47fa07b7259) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: add support for Ignored CVEs

2022-07-08T07:27:20+00:00

Ignored CVEs aren't patched, but do not apply in our configuration for some reason. Up till now they were only partially supported and reported as "Patched". This patch adds separate reporting of Ignored CVEs. The variable CVE_CHECK_REPORT_PATCHED now manages reporting of both patched and ignored CVEs. (From OE-Core rev: 14b3c0ca46a0aa97565a24b7a5116306237d7cfe) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry-picked from c773102d4828fc4ddd1024f6115d577e23f1afe4) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: add coverage statistics on recipes with/without CVEs

2022-06-11T09:06:09+00:00

Until now the CVE checker was giving information about CVEs found for a product (or more products) contained in a recipe. However, there was no easy way to find out which products or recipes have no CVEs. Having no reported CVEs might mean there are simply none, but can also mean a product name (CPE) mismatch. This patch adds CVE_CHECK_COVERAGE option enabling a new type of statistics. Then we use the new JSON format to report the information. The legacy text mode report does not contain it. This option is expected to help with an identification of recipes with mismatched CPEs, issues in the database and more. This work is based on [1], but adding the JSON format makes it easier to implement, without additional result files. [1] https://lists.openembedded.org/g/openembedded-core/message/159873 (From OE-Core rev: c63d06becc340270573bdef2630749db1f5230d4) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni (cherry picked from commit d1849a1facd64fa0bcf8336a0ed5fbf71b2e3cb5) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: write empty fragment files in the text mode

2022-06-11T09:06:09+00:00

In the cve-check text mode output, we didn't write fragment files if there are no CVEs (if CVE_CHECK_REPORT_PATCHED is 1), or no unpached CVEs otherwise. However, in a system after multiple builds, cve_check_write_rootfs_manifest might find older files and use them as current, what leads to incorrect reporting. Fix it by always writing a fragment file, even if empty. (From OE-Core rev: 4c10ee956f21ea2f805403704ac3c54b7f1be78c) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie (cherry picked from commit f1b7877acd0f6e3626faa57d9f89809cfcdfd0f1) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: move update_symlinks to a library

2022-06-11T09:06:09+00:00

Move the function to a library, it could be useful in other places. (From OE-Core rev: c8a0e7ecee15985f7eed10ce9c86c48a77c5b7c5) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie (cherry picked from commit debd37abcdde8788761ebdb4a05bc61f7394cbb8) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: Allow warnings to be disabled

2022-06-04T11:16:59+00:00

When running CVE checks in CI we're usually not interested in warnings on the console for any CVEs present. Add a configuration option CVE_CHECK_SHOW_WARNINGS to allow this to be disabled (it is left enabled by default). (From OE-Core rev: d009233f36fb866f6bdaa12fb6deedf5e253e9c9) Signed-off-by: Richard Purdie (cherry picked from commit 1054d3366ba528f2ad52585cf951e508958c5c68) Signed-off-by: Steve Sakoman (cherry picked from commit 8fd6a9f521ea6b1e10c80fe33968943db30991ba) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: Only include installed packages for rootfs manifest

2022-06-04T11:16:59+00:00

Before this the rootfs manifest and the summary were identical. We should separate the summary and rootfs manifest more clearly, now the summary is for all CVEs and the rootfs manifest is only for things in that image. This is even more useful if you build multiple images. (From OE-Core rev: 2bacd7cc67b2f624885ce9c9c9e48950b359387d) Signed-off-by: Ernst Sjöstrand Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 3b8cc6fc45f0ea5677729ee2b1819bdc7a441ab1) Signed-off-by: Steve Sakoman (cherry picked from commit 65498411d73e8008d5550c2d0a1148f990717587) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: Add helper for symlink handling

2022-06-04T11:16:59+00:00

(From OE-Core rev: 8a178a728f2318c55d5ecaef0ef9e0fd8ebc333b) Signed-off-by: Ernst Sjöstrand Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 5046d54df2c3057be2afa4143a2833183fca0d67) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check.bbclass: Added do_populate_sdk[recrdeptask].

2022-06-04T11:16:59+00:00

As product, sdk should do cve check as well as rootfs. (From OE-Core rev: df09cd71b4cd3f830fced9ce91aa202c1609bfc5) Signed-off-by: Lei Maohui Signed-off-by: Luca Ceresoli (cherry picked from commit cc17753935c5f9e08aaa6c5886f059303147c07b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie