linux/poky.git/meta/classes, branch scarthgap-5.0.8

cve_check: Use a local copy of the database during builds

2024-11-09T13:53:57+00:00

Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from a local copy in STAGING DIR after fetching. (From OE-Core rev: 57de6545695ac11816d670959d9e63666de08e3d) Signed-off-by: Richard Purdie (cherry picked from commit 03596904392d257572a905a182b92c780d636744) Signed-off-by: Steve Sakoman

cve-check: add support for cvss v4.0

2024-11-09T13:53:57+00:00

https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) (From OE-Core rev: 290407b3785bce2d22212a7ab9d3a349c8935cc0) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

create-sdpx-2.2.bbclass: Switch from exists to isfile checking debugsrc

2024-09-25T12:07:47+00:00

While debugsrc is almost always a file (or link), there are apparently cases where a directory could be returned from the dwarfsrcfiles processing. When this happens, the hashing fails and an error results when building the SPDX documents. (From OE-Core rev: cc24c32795e6894387a6e7ebc9b1d9f4215621f0) Signed-off-by: Mark Hatle Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie (cherry picked from commit 02e262c291c0b2066132b4cb2ca5fda8145284a9) Signed-off-by: Mark Hatle Signed-off-by: Steve Sakoman

buildhistory: Simplify intercept call sites and drop SSTATEPOSTINSTFUNC usage

2024-09-25T12:07:47+00:00

We planned to drop SSTATEPOSTINSTFUNC some time ago with the introduction of postfuncs. Finally get around to doing that which should make the buildhistory code a little more readable. Unfortunately ordering the buildhistory function calls after the sstate ones is difficult without coding that into the sstate class. This patch does that to ensure everything functions as expected until we can find a better way. This is still likely preferable than the generic sstate postfuncs support since the function flow is much more readable. (From OE-Core rev: 466c505b779dec2ba790f4e6cde7fbb35037f4ef) Signed-off-by: Richard Purdie (cherry picked from commit c9e2a8fa2f0305ef1247ec405555612326f798f8) Signed-off-by: Steve Sakoman

buildhistory: Restoring files from preserve list

2024-09-25T12:07:47+00:00

This fix will ensure that, when we activate feature `BUILDHISTORY_RESET`, files marked to keep on feature `BUILDHISTORY_PRESERVE` will indeed exist is buildhistory final path since they are moved to buildhistory/old but not restored at any point. (From OE-Core rev: 93ee5b0ee71a51daba9a332e8dba93d78a849677) Signed-off-by: Pedro Ferreira Signed-off-by: Richard Purdie (cherry picked from commit 9f68a45aa238ae5fcdfaca71ba0e7015e9cb720e) Signed-off-by: Steve Sakoman

buildhistory: Fix intermittent package file list creation

2024-09-25T12:07:47+00:00

The directory that buildhistory_list_pkg_files writes to during do_package is created by do_packagedata so a clean buildhistory doesn't have files-in-package written during the first build since packagedata happens after do_package. Ensure the output package folder is created to avoid missing files-in-package.txt files. Also it ensures that in case of `find` fails we leave with a hard error instead of hiding the error on the for loop. (From OE-Core rev: eb94b09a9183e0b0d9cfc45287e0967ae185c099) Signed-off-by: Pedro Silva Ferreira Signed-off-by: Richard Purdie (cherry picked from commit 8de9b8c1e199896b9a7bc5ed64967c6bfbf84bea) Signed-off-by: Steve Sakoman

create-spdx-*: Support multilibs via SPDX_MULTILIB_SSTATE_ARCHS

2024-08-07T02:11:18+00:00

When a create-spdx-* classes is processing documents, it needs to find the document in a path that is related to the SSTATE_ARCH when a packge is generated. The SSTATE_ARCH can be affected by multilib configurations, resulting is something like armv8a-mlib. When the image (or SDK) is being generated and the components are collected, the system has no knowledge of the multilib arch and will fail to find it, such as: ERROR: meta-toolchain-1.0-r0 do_populate_sdk: No SPDX file found for package libilp32-libgcc-dbg, False sstate:libilp32-libgcc:armv8a-ilp32-mllibilp32-elf:14.1.0:r0:armv8a-ilp32:12: sstate:libilp32-libgcc::14.1.0:r0::12: Adding in the new SPDX_MULTILIB_SSTATE_ARCHS will provide a full set of SSTATE_ARCHS including ones that contain the multilib extension which will allow create-spdx-* to correctly find the document it is looking for. This would also be valuable to any other function doing a similar search through SSTATE_ARCH that may have been extended with multilib configurations. (From OE-Core rev: 5c1ce317fff6df6818f72d93197e5ec59ad4c462) Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie (cherry picked from commit f1499c36c1054fc90f7b7268cc95285f2eca72f7) spdx-3.0 items are not application and were removed. spdx-common.bbclass item was moved into create-sdpx-2.2.bbclass. Signed-off-by: Mark Hatle Signed-off-by: Steve Sakoman

archiver.bbclass: Fix work-shared checking for kernel recipes

2024-08-01T13:08:09+00:00

Source dir can be a symbolic link in some BSP's linux kernel recipe which points to work-shared path (like linux-fslc in meta-freescale). Change to use os.path.realpath() in order to get real path of source dir. (From OE-Core rev: 340dc094df5eda4a3834a90578b331d9edcffa94) Signed-off-by: Benjamin Szőke Signed-off-by: Richard Purdie (cherry picked from commit 9191aa685418af32f003e067ef7c5737a271e3a5) Signed-off-by: Steve Sakoman

multilib.bbclass: replace deprecated e.data with d

2024-08-01T13:08:09+00:00

Replace deprecated e.data with d in multilib.bbclass and multilib_global.bbclass. Remove event check in function multilib_virtclass_handler_vendor in multilib_global.bbclass. The function flag 'eventmask' has been set with 'bb.event.ConfigParsed', so no need to check the event any more. (From OE-Core rev: 01a84c3db74e8cc4923016c312a484a252fcfee0) Signed-off-by: Kai Kang Signed-off-by: Richard Purdie (cherry picked from commit 8d87662d676a2b9ef921cb49ea6edc07b37410e2) Signed-off-by: Steve Sakoman

cve-check: Introduce CVE_CHECK_MANIFEST_JSON_SUFFIX

2024-08-01T13:08:09+00:00

The variable contains the suffix of the CVE JSON manifest file. By default, this variable is set to 'json', so the current behavior is not changed, but enables developers to use some other suffix, e.g., cve.json (similar to spdx.json). (From OE-Core rev: 0cb103430d0505a3cd135e727379489bc3fe6e46) Signed-off-by: Aleksandar Nikolic Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit d99eee76923659c0b95bf9ef415ae5d44f736d01) Signed-off-by: Steve Sakoman