From e100e3e0b3f1968421cae59d4a8fb5ea2dfc38c3 Mon Sep 17 00:00:00 2001 From: Andrej Valek Date: Thu, 20 Jul 2023 09:31:30 +0200 Subject: ref-manual: document CVE_STATUS and CVE_CHECK_STATUSMAP Deprecate CVE_CHECK_IGNORE with CVE_STATUS (From yocto-docs rev: 8b8054977f31e2d6090521a0102f066b6d563733) Signed-off-by: Andrej Valek Signed-off-by: Peter Marko Reviewed-by: Michael Opdenacker Signed-off-by: Richard Purdie --- documentation/ref-manual/classes.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'documentation/ref-manual/classes.rst') diff --git a/documentation/ref-manual/classes.rst b/documentation/ref-manual/classes.rst index 4577baba3e..a7819d5b60 100644 --- a/documentation/ref-manual/classes.rst +++ b/documentation/ref-manual/classes.rst @@ -517,10 +517,10 @@ The ``Patched`` state of a CVE issue is detected from patch files with the forma ``CVE-ID.patch``, e.g. ``CVE-2019-20633.patch``, in the :term:`SRC_URI` and using CVE metadata of format ``CVE: CVE-ID`` in the commit message of the patch file. -If the recipe lists the ``CVE-ID`` in :term:`CVE_CHECK_IGNORE` variable, then the CVE state is reported -as ``Ignored``. Multiple CVEs can be listed separated by spaces. Example:: +If the recipe adds ``CVE-ID`` as flag of the :term:`CVE_STATUS` variable with status +mapped to ``Ignored``, then the CVE state is reported as ``Ignored``:: - CVE_CHECK_IGNORE += "CVE-2020-29509 CVE-2020-29511" + CVE_STATUS[CVE-2020-15523] = "not-applicable-platform: Issue only applies on Windows" If CVE check reports that a recipe contains false positives or false negatives, these may be fixed in recipes by adjusting the CVE product name using :term:`CVE_PRODUCT` and :term:`CVE_VERSION` variables. -- cgit v1.2.3-54-g00ecf