summaryrefslogtreecommitdiffstats
path: root/meta/lib/oe/cve_check.py
Commit message (Collapse)AuthorAgeFilesLines
* cve-check: extract extending CVE_STATUS to library functionBenjamin Robin (Schneider Electric)2025-12-011-0/+22
| | | | | | | | | | | | | | | | | | | The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve_check: cleanup loggingRoss Burton2024-01-231-7/+6
| | | | | | | | | | | | Primarily list the number of patches found, useful when debugging. Also clean up some bad escaping that caused warnings and use re.IGNORECASE instead of manually doing case-insenstive rang matches. (From OE-Core rev: 10acc75b7f3387b968bacd51aade6a8dc11a463f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: handle CVE_STATUS being set to the empty stringRoss Burton2024-01-231-2/+2
| | | | | | | | | | | | | Handle CVE_STATUS[...] being set to an empty string just as if it was not set at all. This is needed for evaluated CVE_STATUS values to work, i.e. when setting not-applicable-config if a PACKAGECONFIG is disabled. (From OE-Core rev: 2c9f20f746251505d9d09262600199ffa87731a2) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: don't warn if a patch is remoteRoss Burton2023-11-031-5/+6
| | | | | | | | | | | | | | | | We don't make do_cve_check depend on do_unpack because that would be a waste of time 99% of the time. The compromise here is that we can't scan remote patches for issues, but this isn't a problem so downgrade the warning to a note. Also move the check for CVEs in the filename before the local file check so that even with remote patches, we still check for CVE references in the name. (From OE-Core rev: 0251cad677579f5b4dcc25fa2f8552c6040ac2cf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: slightly more verbose warning when adding the same package twiceRoss Burton2023-10-261-1/+1
| | | | | | | | | | | Occasionally the cve-check tool will warn that it is adding the same package twice. Knowing what this package is might be the first step towards understanding where this message comes from. (From OE-Core rev: c1179faec8583a8b7df192cf1cbf221f0e3001fc) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: Fix cpe_id generationJasper Orschulko2023-08-221-1/+1
| | | | | | | | | | | | | | Use "*" (wildcard) instead of "a" (application)in cpe_id generation, as the product is not necessarily of type application, e.g. linux_kernel, which is of type "o" (operating system). (From OE-Core rev: cae9528b002c06143bf048b991b9d7e93968cb6b) (From OE-Core rev: e7c1def3c3c3a72249802ef6fb64292277a7a53e) Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add option to add additional patched CVEsAndrej Valek2023-07-191-0/+25
| | | | | | | | | | | | | | | | | | | | | | - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - description: free text describing reason for status Examples of usage: CVE_STATUS[CVE-1234-0001] = "not-applicable-platform: Issue only applies on Windows" CVE_STATUS[CVE-1234-0002] = "fixed-version: Fixed externally" CVE_CHECK_STATUSMAP[not-applicable-platform] = "Ignored" CVE_CHECK_STATUSMAP[fixed-version] = "Patched" (From OE-Core rev: 34f682a24b7075b12ec308154b937ad118d69fe5) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Fix false negative version issueGeoffrey GIRY2023-03-301-0/+39
| | | | | | | | | | | | | | | NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL <yoann.congal@smile.fr> (From OE-Core rev: 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Geoffrey GIRY <geoffrey.giry@smile.fr> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Don't use f-stringsErnst Sjöstrand2022-08-141-1/+1
| | | | | | | | | | | Since we're keeping cve-check aligned between the active branches, and dunfell is supported on Python 3.5, we can't use f-strings. (From OE-Core rev: 1821cf7464cbba521b55a9c128fe8812c0cc5eca) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib: Add copyright statements to files without oneRichard Purdie2022-08-121-0/+6
| | | | | | | | | Where there isn't a copyright statement, add one to make it explicit. Also add license identifiers as MIT if there isn't one. (From OE-Core rev: bb731d1f3d2a1d50ec0aed864dbca54cf795b040) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: move update_symlinks to a libraryMarta Rybczynska2022-06-061-0/+10
| | | | | | | | | Move the function to a library, it could be useful in other places. (From OE-Core rev: debd37abcdde8788761ebdb4a05bc61f7394cbb8) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: skip remote patches that haven't been fetched when searching for ↵Ross Burton2022-04-281-2/+3
| | | | | | | | | | | | | | | | | CVE tags If a remote patch is compressed we need to have run the unpack task for the file to exist locally. Currently cve_check only depends on fetch so instead of erroring out, emit a warning that this file won't be scanned for CVE references. Typically, remote compressed patches won't contain our custom tags, so this is unlikely to be an issue. (From OE-Core rev: cefc8741438c91f74264da6b59dece2e31f9e5a5) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add json formatMarta Rybczynska2022-03-301-0/+16
| | | | | | | | | | | | | | | | | | | | | Add an option to output the CVE check in a JSON-based format. This format is easier to parse in software than the original text-based one and allows post-processing by other tools. Output formats are now handed by CVE_CHECK_FORMAT_TEXT and CVE_CHECK_FORMAT_JSON. Both of them are enabled by default. The JSON output format gets generated in a similar way to the text format with the exception of the manifest: appending to JSON arrays requires parsing the file. Because of that we first write JSON fragments and then assemble them in one pass at the end. (From OE-Core rev: df567de36ae5964bee433ebb97e8bf702034994a) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/cve-check: Move get_patches_cves to libraryJoshua Watt2021-08-131-0/+83
| | | | | | | | | | | | | | Moving the function will allow other classes to capture which CVEs have been patched, in particular SBoM generation. Also add a function to capture the CPE ID from the CVE Product and Version (From OE-Core rev: 75d34259a715120be1d023e4fd7b6b4b125f2443) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: CVE_VERSION_SUFFIX to work with patched releaseLee Chee Yang2021-03-201-1/+6
| | | | | | | | | | | | | CVE_VERSION_SUFFIX in "patch" to treat version string with suffix "pX" or "patchX" as patched release. also update testcases to cover this changes and set CVE_VERSION_SUFFIX for sudo. (From OE-Core rev: 8076815fc2ffc8f632e73527ce2b7d158a29e9ea) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: add CVE_VERSION_SUFFIX to indicate suffix in versioningLee Chee Yang2021-01-301-19/+21
| | | | | | | | | | | | | | | | | | add CVE_VERSION_SUFFIX to indicate the version suffix type, currently works in two value, "alphabetical" if the version string uses single alphabetical character suffix as incremental release, blank to not consider the unidentified suffixes. This can be expand when more suffix pattern identified. refactor cve_check.Version class to use functools and add parameter to handle suffix condition. Also update testcases to cover new changes. (From OE-Core rev: 5dfd5ad5144708b474ef31eaa89a846c57be8ac0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: replace Looseversion with custom version classLee Chee Yang2021-01-231-0/+58
The way distutils.version.LooseVersion compare version are tricky, it treat all these ( "1.0-beta2", "1.0-rc1", "1.0A", "1.0p2" and "1.0pre1") as greater version than "1.0". This might be right for "1.0A" and "1.0p1" but not for the rest, also these version could be confusing, the "p" in "1.0p1" can be "pre" or "patched" version or even other meaning. Replace Looseversion with custom class, it uses regex to capture common version format like "1.1.1" or tag format using date like "2020-12-12" as release section, check for following known string/tags ( beta, rc, pre, dev, alpha, preview) as pre-release section, any other trailing characters are difficult to understand/define so ignore them. Compare release section and pre-release section saperately. included selftest for the version class. [YOCTO#14127] (From OE-Core rev: 6ced85e9ddd3569240f1e8b82130d1ac0fffbc40) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-21 18:36:57 +0000