linux/poky.git/meta/classes, branch scarthgap-5.0.13

cve-check: Add missing call to exit_if_errors

2025-08-22T12:59:54+00:00

check_cves may raise the cve_status_not_in_db QA check. Call exit_if_errors to make sure that the task is marked as failed when the check is categorized as an error. cve_status_not_in_db was in the meantime dropped in OE-Core 452e605b55ad61c08f4af7089a5a9c576ca28f7d so this change is only required on scarthgap. (From OE-Core rev: b3d12589c26f4e86b153bbdcda774985e4e046bd) Signed-off-by: Philip Lorenz Signed-off-by: Steve Sakoman

spdx: add option to include only compiled sources

2025-07-07T14:42:58+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. Tested with bitbake world on oe-core. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for create-spdx-2.2 CC: Mathieu Dubois-Briand CC: Joshua Watt (From OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b) Signed-off-by: Daniel Turull Signed-off-by: Steve Sakoman

cve-check.bbclass: Fix symlink handling also for text files

2025-05-19T15:32:49+00:00

While backporting commit 7543e4e24a8b ("cve-check.bbclass: Mitigate symlink related error") I failed to address the fact that in Scarthgap this bbclass still generates also the text CVE file, in addition to the JSON file. In order to avoid the error that occurred with JSON files from occurring now with CVE files: ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.cve (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. update the symlink handling for the text file variant too. (From OE-Core rev: 81e702c85c62782dbedd5ca2a5e6569e6339dd60) Signed-off-by: Niko Mauno Signed-off-by: Steve Sakoman

cve-check.bbclass: Mitigate symlink related error

2025-03-15T13:40:08+00:00

According to Yocto reference manual, in description of the IMAGE_LINK_NAME variable, it is said that It is possible to set this to "" to disable symlink creation, however, you also need to set :term:`IMAGE_NAME` to still have a reasonable value e.g.:: IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" However, when using following additions in local.conf file: INHERIT += "cve-check" IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" the implicit symlink creation in cve_check_write_rootfs_manifest leads to following build failure $ bitbake core-image-minimal core-image-base ... ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.json (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME has not been set to empty string. (From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1) (From OE-Core rev: 35e210e3ebe21f1f4466760076b7140618af536e) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

cve_check: Use a local copy of the database during builds

2024-11-09T13:53:57+00:00

Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from a local copy in STAGING DIR after fetching. (From OE-Core rev: 57de6545695ac11816d670959d9e63666de08e3d) Signed-off-by: Richard Purdie (cherry picked from commit 03596904392d257572a905a182b92c780d636744) Signed-off-by: Steve Sakoman

cve-check: add support for cvss v4.0

2024-11-09T13:53:57+00:00

https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) (From OE-Core rev: 290407b3785bce2d22212a7ab9d3a349c8935cc0) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

create-sdpx-2.2.bbclass: Switch from exists to isfile checking debugsrc

2024-09-25T12:07:47+00:00

While debugsrc is almost always a file (or link), there are apparently cases where a directory could be returned from the dwarfsrcfiles processing. When this happens, the hashing fails and an error results when building the SPDX documents. (From OE-Core rev: cc24c32795e6894387a6e7ebc9b1d9f4215621f0) Signed-off-by: Mark Hatle Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie (cherry picked from commit 02e262c291c0b2066132b4cb2ca5fda8145284a9) Signed-off-by: Mark Hatle Signed-off-by: Steve Sakoman

buildhistory: Simplify intercept call sites and drop SSTATEPOSTINSTFUNC usage

2024-09-25T12:07:47+00:00

We planned to drop SSTATEPOSTINSTFUNC some time ago with the introduction of postfuncs. Finally get around to doing that which should make the buildhistory code a little more readable. Unfortunately ordering the buildhistory function calls after the sstate ones is difficult without coding that into the sstate class. This patch does that to ensure everything functions as expected until we can find a better way. This is still likely preferable than the generic sstate postfuncs support since the function flow is much more readable. (From OE-Core rev: 466c505b779dec2ba790f4e6cde7fbb35037f4ef) Signed-off-by: Richard Purdie (cherry picked from commit c9e2a8fa2f0305ef1247ec405555612326f798f8) Signed-off-by: Steve Sakoman

buildhistory: Restoring files from preserve list

2024-09-25T12:07:47+00:00

This fix will ensure that, when we activate feature `BUILDHISTORY_RESET`, files marked to keep on feature `BUILDHISTORY_PRESERVE` will indeed exist is buildhistory final path since they are moved to buildhistory/old but not restored at any point. (From OE-Core rev: 93ee5b0ee71a51daba9a332e8dba93d78a849677) Signed-off-by: Pedro Ferreira Signed-off-by: Richard Purdie (cherry picked from commit 9f68a45aa238ae5fcdfaca71ba0e7015e9cb720e) Signed-off-by: Steve Sakoman

buildhistory: Fix intermittent package file list creation

2024-09-25T12:07:47+00:00

The directory that buildhistory_list_pkg_files writes to during do_package is created by do_packagedata so a clean buildhistory doesn't have files-in-package written during the first build since packagedata happens after do_package. Ensure the output package folder is created to avoid missing files-in-package.txt files. Also it ensures that in case of `find` fails we leave with a hard error instead of hiding the error on the for loop. (From OE-Core rev: eb94b09a9183e0b0d9cfc45287e0967ae185c099) Signed-off-by: Pedro Silva Ferreira Signed-off-by: Richard Purdie (cherry picked from commit 8de9b8c1e199896b9a7bc5ed64967c6bfbf84bea) Signed-off-by: Steve Sakoman