linux/poky.git/meta/lib/oe/cve_check.py, branch scarthgap

cve-check: extract extending CVE_STATUS to library function

2025-12-01T15:34:55+00:00

The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman

cve_check: cleanup logging

2024-01-23T11:53:41+00:00

Primarily list the number of patches found, useful when debugging. Also clean up some bad escaping that caused warnings and use re.IGNORECASE instead of manually doing case-insenstive rang matches. (From OE-Core rev: 10acc75b7f3387b968bacd51aade6a8dc11a463f) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve_check: handle CVE_STATUS being set to the empty string

2024-01-23T11:53:41+00:00

Handle CVE_STATUS[...] being set to an empty string just as if it was not set at all. This is needed for evaluated CVE_STATUS values to work, i.e. when setting not-applicable-config if a PACKAGECONFIG is disabled. (From OE-Core rev: 2c9f20f746251505d9d09262600199ffa87731a2) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: don't warn if a patch is remote

2023-11-03T16:58:40+00:00

We don't make do_cve_check depend on do_unpack because that would be a waste of time 99% of the time. The compromise here is that we can't scan remote patches for issues, but this isn't a problem so downgrade the warning to a note. Also move the check for CVEs in the filename before the local file check so that even with remote patches, we still check for CVE references in the name. (From OE-Core rev: 0251cad677579f5b4dcc25fa2f8552c6040ac2cf) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-check: slightly more verbose warning when adding the same package twice

2023-10-26T14:29:34+00:00

Occasionally the cve-check tool will warn that it is adding the same package twice. Knowing what this package is might be the first step towards understanding where this message comes from. (From OE-Core rev: c1179faec8583a8b7df192cf1cbf221f0e3001fc) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve_check: Fix cpe_id generation

2023-08-22T14:13:54+00:00

Use "*" (wildcard) instead of "a" (application)in cpe_id generation, as the product is not necessarily of type application, e.g. linux_kernel, which is of type "o" (operating system). (From OE-Core rev: cae9528b002c06143bf048b991b9d7e93968cb6b) (From OE-Core rev: e7c1def3c3c3a72249802ef6fb64292277a7a53e) Signed-off-by: Jasper Orschulko Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

cve-check: add option to add additional patched CVEs

2023-07-19T22:25:01+00:00

- Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - description: free text describing reason for status Examples of usage: CVE_STATUS[CVE-1234-0001] = "not-applicable-platform: Issue only applies on Windows" CVE_STATUS[CVE-1234-0002] = "fixed-version: Fixed externally" CVE_CHECK_STATUSMAP[not-applicable-platform] = "Ignored" CVE_CHECK_STATUSMAP[fixed-version] = "Patched" (From OE-Core rev: 34f682a24b7075b12ec308154b937ad118d69fe5) Signed-off-by: Andrej Valek Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

cve-check: Fix false negative version issue

2023-03-30T11:30:38+00:00

NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL (From OE-Core rev: 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Geoffrey GIRY Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-check: Don't use f-strings

2022-08-14T07:13:32+00:00

Since we're keeping cve-check aligned between the active branches, and dunfell is supported on Python 3.5, we can't use f-strings. (From OE-Core rev: 1821cf7464cbba521b55a9c128fe8812c0cc5eca) Signed-off-by: Ernst Sjöstrand Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lib: Add copyright statements to files without one

2022-08-12T11:00:43+00:00

Where there isn't a copyright statement, add one to make it explicit. Also add license identifiers as MIT if there isn't one. (From OE-Core rev: bb731d1f3d2a1d50ec0aed864dbca54cf795b040) Signed-off-by: Richard Purdie