From 7d41877ce9f17fe3f5f1827fad7589338d9f295b Mon Sep 17 00:00:00 2001 From: Paul Eggleton Date: Sun, 14 Apr 2024 13:43:12 -0700 Subject: ref-manual: classes: cve_check: add note about remote patches Document the change in behaviour in 5.0. (From yocto-docs rev: f7a223d4e78bee67107fa47e147208f57a2d9521) Signed-off-by: Paul Eggleton Reviewed-by: Michael Opdenacker Signed-off-by: Richard Purdie --- documentation/ref-manual/classes.rst | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'documentation') diff --git a/documentation/ref-manual/classes.rst b/documentation/ref-manual/classes.rst index 8d69e9947f..9520d0bf7c 100644 --- a/documentation/ref-manual/classes.rst +++ b/documentation/ref-manual/classes.rst @@ -564,6 +564,13 @@ The ``Patched`` state of a CVE issue is detected from patch files with the forma ``CVE-ID.patch``, e.g. ``CVE-2019-20633.patch``, in the :term:`SRC_URI` and using CVE metadata of format ``CVE: CVE-ID`` in the commit message of the patch file. +.. note:: + + Commit message metadata (``CVE: CVE-ID`` in a patch header) will not be scanned + in any patches that are remote, i.e. that are anything other than local files + referenced via ``file://`` in SRC_URI. However, a ``CVE-ID`` in a remote patch + file name itself will be registered. + If the recipe adds ``CVE-ID`` as flag of the :term:`CVE_STATUS` variable with status mapped to ``Ignored``, then the CVE state is reported as ``Ignored``:: -- cgit v1.2.3-54-g00ecf