linux/poky.git/meta/classes/cve-check.bbclass, branch yocto-4.0.1

cve-check: fix symlinks where link and output path are equal

2022-05-12T15:44:06+00:00

An if statement now checks if the link and output path are the same, if they are then the link is not created, otherwise it is. (From OE-Core rev: 2fd7f3b7dc964b59b268dd4a34761f9f71f61c25) Signed-off-by: Davide Gardenal Signed-off-by: Luca Ceresoli (cherry picked from commit 2f024c0236c4806f0e59e4ce51a42f6b80fdf1b3) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: add JSON format to summary output

2022-05-12T15:44:06+00:00

Create generate_json_report including all the code used to generate the JSON manifest file. Add to cve_save_summary_handler the ability to create the summary in JSON format. (From OE-Core rev: 8a79c476706b25e5c707c65b4e46b6e940874bd6) Signed-off-by: Davide Gardenal Signed-off-by: Luca Ceresoli (cherry picked from commit f2987891d315466b7ef180ecce81d15320ce8487) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: no need to depend on the fetch task

2022-05-12T15:44:06+00:00

The only part of the cve-check task which needs files is the patch examination, and typically these patches are local so fetch isn't needed. (From OE-Core rev: a76b642736d78cd4dec0ae264da6d0ffd4e9aaf7) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 2c9b3186d3b7c18cbea239ab9b06e85b7c243b54) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: add coverage statistics on recipes with/without CVEs

2022-03-30T12:07:41+00:00

Until now the CVE checker was giving information about CVEs found for a product (or more products) contained in a recipe. However, there was no easy way to find out which products or recipes have no CVEs. Having no reported CVEs might mean there are simply none, but can also mean a product name (CPE) mismatch. This patch adds CVE_CHECK_COVERAGE option enabling a new type of statistics. Then we use the new JSON format to report the information. The legacy text mode report does not contain it. This option is expected to help with an identification of recipes with mismatched CPEs, issues in the database and more. This work is based on [1], but adding the JSON format makes it easier to implement, without additional result files. [1] https://lists.openembedded.org/g/openembedded-core/message/159873 (From OE-Core rev: d1849a1facd64fa0bcf8336a0ed5fbf71b2e3cb5) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: add json format

2022-03-30T12:07:41+00:00

Add an option to output the CVE check in a JSON-based format. This format is easier to parse in software than the original text-based one and allows post-processing by other tools. Output formats are now handed by CVE_CHECK_FORMAT_TEXT and CVE_CHECK_FORMAT_JSON. Both of them are enabled by default. The JSON output format gets generated in a similar way to the text format with the exception of the manifest: appending to JSON arrays requires parsing the file. Because of that we first write JSON fragments and then assemble them in one pass at the end. (From OE-Core rev: df567de36ae5964bee433ebb97e8bf702034994a) Signed-off-by: Marta Rybczynska Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

meta/scripts: Improve internal variable naming

2022-03-10T08:00:28+00:00

Update internal variable names to improve the terms used. (From OE-Core rev: f408068e5d7998ae165f3002e51bc54b380b8099) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

Revert "cve-check: add lockfile to task"

2022-02-27T12:34:40+00:00

Now that all of the functions in cve-check open the database read-only, we can remove this lockfile. This means cve-check can run in parallal again, improving runtimes massively. This reverts commit d55fbf4779483d2cfd71df78d0f733b599fef739. (From OE-Core rev: d3d3e7b324698ec3e6fce1951aba389805f3edd3) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: get_cve_info should open the database read-only

2022-02-25T12:41:23+00:00

All of the function in cve-check should open the database read-only, as the only writer is the fetch task in cve-update-db. However, get_cve_info() was failing to do this, which might be causing locking issues with sqlite. (From OE-Core rev: 8de517238f1f418d9af1ce312d99de04ce2e26fc) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

meta/scripts: Automated conversion of OE renamed variables

2022-02-21T23:37:27+00:00

(From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81) Signed-off-by: Richard Purdie

cve-check: create directory of CVE_CHECK_MANIFEST before copy

2022-02-07T10:08:59+00:00

Create directory of the CVE_CHECK_MANIFEST variable before copy to it, so that the variable can use an arbitrary directory name. (From OE-Core rev: 9829c16301bf2dce39fa046401a984f112fa0322) Signed-off-by: Stefan Herbrechtsmeier Signed-off-by: Richard Purdie