linux/poky.git/meta/classes/cve-check.bbclass, branch yocto-3.4.3

Revert "cve-check: add lockfile to task"

2022-03-10T16:39:50+00:00

Now that all of the functions in cve-check open the database read-only, we can remove this lockfile. This means cve-check can run in parallal again, improving runtimes massively. This reverts commit d55fbf4779483d2cfd71df78d0f733b599fef739. (From OE-Core rev: ecec5339a35f0578669642fc72cbaad2f83bb272) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit d3d3e7b324698ec3e6fce1951aba389805f3edd3) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: get_cve_info should open the database read-only

2022-03-10T16:39:50+00:00

All of the function in cve-check should open the database read-only, as the only writer is the fetch task in cve-update-db. However, get_cve_info() was failing to do this, which might be causing locking issues with sqlite. (From OE-Core rev: 3c79237085169b96cc56910b08263437cad09e4d) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 8de517238f1f418d9af1ce312d99de04ce2e26fc) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: create directory of CVE_CHECK_MANIFEST before copy

2022-02-24T11:12:39+00:00

Create directory of the CVE_CHECK_MANIFEST variable before copy to it, so that the variable can use an arbitrary directory name. (From OE-Core rev: 74888f3ba0c31d635930d94b066750e5440cc906) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie (cherry picked from commit 9829c16301bf2dce39fa046401a984f112fa0322) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

cve-check: add lockfile to task

2022-01-19T11:11:57+00:00

this should prevent running into the very rare error sqlite3.OperationalError: attempt to write a readonly database As highlighted by https://www.sqlite.org/faq.html#q5 it is likely that the adapter won't allow use multiple exec calls at the same time. So it's best to prevent multiple accesses at a time, by reusing the already in place CVE_CHECK_DB_FILE_LOCK YOCTO #14110 (From OE-Core rev: 53dc9b10eb5f064c68120337126f1542c1e0c832) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie (cherry picked from commit 677f5741bd265be49d4a5bb933b3e8d8c4eec653) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

classes/cve-check: Move get_patches_cves to library

2021-08-13T13:44:06+00:00

Moving the function will allow other classes to capture which CVEs have been patched, in particular SBoM generation. Also add a function to capture the CPE ID from the CVE Product and Version (From OE-Core rev: 75d34259a715120be1d023e4fd7b6b4b125f2443) Signed-off-by: Joshua Watt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: remove deprecated CVE_CHECK_CVE_WHITELIST

2021-08-12T05:26:15+00:00

This variable has been deprecated since Yocto Project version 3.0. (From OE-Core rev: f8ac58568b2dceef54a743369460019b3a3eeccd) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie

cve-check: improve comment about CVE patch file names

2021-08-06T05:34:58+00:00

(From OE-Core rev: 8aa613480663e11ecc62278d8c57ca719eb23899) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie

cve-check: update link to NVD website for CVE details

2021-08-06T05:34:58+00:00

The old URL schema https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-ID now redirects to https://nvd.nist.gov/vuln/detail/CVE-ID (From OE-Core rev: 57adb57a9d9b08c08ab606ec7b561792e4f4ff2d) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie

cve-check: fix comments

2021-08-06T05:34:58+00:00

This implements various fixes in comments in cve-check.bbclass In particular, the "whitlisted" typo is important as the "whitelisted" word is going to be replaced in a near future. (From OE-Core rev: 5eecd2bf942254d08c252388594e5ec7ae330f45) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie

Convert to new override syntax

2021-08-02T14:44:10+00:00

This is the result of automated script conversion: scripts/contrib/convert-overrides.py converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie