diff options
author | Michael Opdenacker <michael.opdenacker@bootlin.com> | 2023-01-05 08:34:26 +0100 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-01-06 17:39:09 +0000 |
commit | 8b1909aa6f7a51a878dc3d4a9223403ad3e164a9 (patch) | |
tree | e1418f545ad6640afb5fde004696eef2a9e6e67b /documentation/dev-manual/vulnerabilities.rst | |
parent | ae280972ffba62d7ed839b692957f61b0955cbca (diff) | |
download | poky-8b1909aa6f7a51a878dc3d4a9223403ad3e164a9.tar.gz |
manuals: simplify references to classes
Now that .bbclass is removed from class section titles.
We can now have, for example, :ref:`ref-classes-insane`
instead of :ref:`insane <ref-classes-insane>`.
Then, when necessary, rework paragraphs so that they
have lines of even length, not exceeding 80 characters.
(From yocto-docs rev: e76190e3be78c1e483bec0469f1e437dbf8f3791)
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Suggested-by: Quentin Schulz <foss+yocto@0leil.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'documentation/dev-manual/vulnerabilities.rst')
-rw-r--r-- | documentation/dev-manual/vulnerabilities.rst | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/documentation/dev-manual/vulnerabilities.rst b/documentation/dev-manual/vulnerabilities.rst index f8dac5edc6..0ee3ec52c5 100644 --- a/documentation/dev-manual/vulnerabilities.rst +++ b/documentation/dev-manual/vulnerabilities.rst | |||
@@ -27,8 +27,9 @@ patches to fix them, see ":ref:`dev-manual/changes:submitting a change to the yo | |||
27 | Vulnerability check at build time | 27 | Vulnerability check at build time |
28 | ================================= | 28 | ================================= |
29 | 29 | ||
30 | To enable a check for CVE security vulnerabilities using :ref:`cve-check <ref-classes-cve-check>` in the specific image | 30 | To enable a check for CVE security vulnerabilities using |
31 | or target you are building, add the following setting to your configuration:: | 31 | :ref:`ref-classes-cve-check` in the specific image or target you are building, |
32 | add the following setting to your configuration:: | ||
32 | 33 | ||
33 | INHERIT += "cve-check" | 34 | INHERIT += "cve-check" |
34 | 35 | ||
@@ -100,7 +101,7 @@ It is also possible to check the CVE status of individual packages as follows:: | |||
100 | Fixing CVE product name and version mappings | 101 | Fixing CVE product name and version mappings |
101 | ============================================ | 102 | ============================================ |
102 | 103 | ||
103 | By default, :ref:`cve-check <ref-classes-cve-check>` uses the recipe name :term:`BPN` as CVE | 104 | By default, :ref:`ref-classes-cve-check` uses the recipe name :term:`BPN` as CVE |
104 | product name when querying the CVE database. If this mapping contains false positives, e.g. | 105 | product name when querying the CVE database. If this mapping contains false positives, e.g. |
105 | some reported CVEs are not for the software component in question, or false negatives like | 106 | some reported CVEs are not for the software component in question, or false negatives like |
106 | some CVEs are not found to impact the recipe when they should, then the problems can be | 107 | some CVEs are not found to impact the recipe when they should, then the problems can be |
@@ -167,8 +168,7 @@ the :term:`CVE_CHECK_SKIP_RECIPE` variable. | |||
167 | Implementation details | 168 | Implementation details |
168 | ====================== | 169 | ====================== |
169 | 170 | ||
170 | Here's what the :ref:`cve-check <ref-classes-cve-check>` class does to | 171 | Here's what the :ref:`ref-classes-cve-check` class does to find unpatched CVE IDs. |
171 | find unpatched CVE IDs. | ||
172 | 172 | ||
173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID | 173 | First the code goes through each patch file provided by a recipe. If a valid CVE ID |
174 | is found in the name of the file, the corresponding CVE is considered as patched. | 174 | is found in the name of the file, the corresponding CVE is considered as patched. |