linux/poky.git/scripts/contrib, branch scarthgap

scripts: Default to https git protocol for YP/OE repos

2026-05-04T12:57:32+00:00

Following up on commit 139102a73d41 ("recipes: Default to https git protocol where possible"), > The recommendation from server maintainers is that the https protocol > is both faster and more reliable than the dedicated git protocol at this point. > Switch to it where possible. (From OE-Core rev: b9de796f797844b035e50e22c4f939fc90e176f8) Signed-off-by: Yoann Congal Signed-off-by: Richard Purdie (cherry picked from commit 74dd04549624b1d3ba6d4febe51fa9ba1c86944c) Signed-off-by: Paul Barker

improve_kernel_cve_report: add option to read debugsources.zstd

2026-03-25T17:34:13+00:00

Adding option to be able to import debugsources.zstd directly. The linux-yocto-debugsources.zstd is generated in every build and does not require any additional configuration. In contrast, SPDX_INCLUDE_COMPILED_SOURCES needs to be explicitly added and increases build time. (From OE-Core rev: e8e61a97bf0e88c45a323353e865a5654a500966) Signed-off-by: Daniel Turull Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit c84a8958f30bbb982656ddcbe7476f6f81e1a6fb) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

improve_kernel_cve_report: do not use custom version

2026-03-25T17:34:13+00:00

When using the version specified in cve-summary.json, we need to remove the suffix containing the custom version to match the versions from the CVEs. This patch truncates the version from cve-summary.json to use only the base version of the kernel. This is only applicable for kernels where the user has added their own version. (From OE-Core rev: 66968d81d55de7afdf139eac56a460d04c383a6c) Signed-off-by: Daniel Turull Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 3942d40e96989268e8d1030f9d8c3859044d9635) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

improve_kernel_cve_report: do not override backported-patch

2026-03-25T17:34:13+00:00

If the user has a CVE_STATUS for their own backported patch, the backport takes priority over upstream vulnerable versions. (From OE-Core rev: d317e2a52bd29a772de9bcd751f5b0e03277bd77) Signed-off-by: Daniel Turull Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 0beef05be119ea465ba06553a42edea03dfc9fd3) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

improve_kernel_cve_report: add script for postprocesing of kernel CVE data

2026-02-16T09:52:35+00:00

Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source. Example of enhanced CVE from a report from cve-check: { "id": "CVE-2024-26710", "status": "Ignored", "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710", "summary": "In the Linux kernel, the following vulnerability [...]", "scorev2": "0.0", "scorev3": "5.5", "scorev4": "0.0", "modified": "2025-03-17T15:36:11.620", "vector": "LOCAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "detail": "not-applicable-config", "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']" }, And same from a report generated with vex: { "id": "CVE-2024-26710", "status": "Ignored", "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710", "detail": "not-applicable-config", "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']" }, For unpatched CVEs, provide more context in the description: Tested with 6.12.22 kernel { "id": "CVE-2025-39728", "status": "Unpatched", "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728", "summary": "In the Linux kernel, the following vulnerability has been [...], "scorev2": "0.0", "scorev3": "0.0", "scorev4": "0.0", "modified": "2025-04-21T14:23:45.950", "vector": "UNKNOWN", "vectorString": "UNKNOWN", "detail": "version-in-range", "description": "Needs backporting (fixed from 6.12.23)" }, CC: Peter Marko CC: Marta Rybczynska (From OE-Core rev: 7637af0a94764ac0c6c4f02f383992bcb4753af0) Signed-off-by: Daniel Turull Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57) Signed-off-by: Suresh H A [Yoann: Stable policy exception: This change is clearly a new feature and thus should be rejected from stables by policy. But, since this is contrib/ an exception can be made] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

scripts: python 3.12 regex

2024-02-13T13:51:41+00:00

All the regexes throw a warning like this: WARNING: scripts/lib/recipetool/create_buildsys.py:140: SyntaxWarning: invalid escape sequence '\s' proj_re = re.compile('project\s*\(([^)]*)\)', re.IGNORECASE) Python 3 interprets string literals as Unicode strings, and therefore \s is treated as an escaped Unicode character which is not correct. Declaring the RegEx pattern as a raw string instead of unicode is required for Python 3. (From OE-Core rev: 24b0ba00d4f0b4d9834f7693ecb6032dfc534a80) Signed-off-by: Adrian Freihofer Signed-off-by: Richard Purdie

scripts/contrib/patchreview: fix commit identification

2023-10-30T11:53:20+00:00

git show-ref looks at the _remote_ ref called HEAD, which is fine when it matches the local HEAD but problematic when you're iterating a series of commits. Use rev-parse to resolve the local name to a proper hash. (From OE-Core rev: 3c04747b681cf6090ba9c77752f6c2f304dbbe17) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

scripts/contrib/patchreview: consolidate imports

2023-10-27T16:48:11+00:00

Move most imports to the top of the file. (From OE-Core rev: d2c287db0739b249604cd1beaa03ec38512ba718) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

scripts/contrib/patchreview: add commit and recipe count fields to JSON

2023-10-27T16:48:11+00:00

The autobuilder scripts post-process the generated JSON to inject recipe and commit counts into the data. We can do this easily in patchreview instead. (From OE-Core rev: 77c96e43090cbf485aec612cc2315b85e5635dda) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

scripts/patchreview: rework patch detection

2023-10-27T16:48:11+00:00

A previous patch[1] added the ability to allow the search pattern for patches to be changed, so that patchreview can be used across the entire meta-oe repository by changing the patterns. However, this means the caller needs to write long patterns when calling patchreview. Instead, we can see if the specified directory contains a layer by checking if conf/layer.conf exists. If it does, then search for patches inside this directory. If it doesn't, assume that the specified directory is a repository that contains sublayers (such as meta-openembedded) and look through each of the directories that match the pattern meta-*. This means patchreview can both scan either a single layer (eg .../poky/meta) or a repository of sublayers (eg .../meta-openembedded). [1] oe-core 599046ea9302af0cf856d3fcd827f6a2be75b7e1 (From OE-Core rev: a3a868519beab1b9cac94fefd7dbeffb09d047e9) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie