From be9883a92bad0fe4c1e9c7302c93dea4ac680f8c Mon Sep 17 00:00:00 2001 From: Andrej Valek Date: Fri, 23 Jun 2023 13:14:56 +0200 Subject: cve-check: add option to add additional patched CVEs - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - description: free text describing reason for status Examples of usage: CVE_STATUS[CVE-1234-0001] = "not-applicable-platform: Issue only applies on Windows" CVE_STATUS[CVE-1234-0002] = "fixed-version: Fixed externally" CVE_CHECK_STATUSMAP[not-applicable-platform] = "Ignored" CVE_CHECK_STATUSMAP[fixed-version] = "Patched" (From OE-Core rev: 34f682a24b7075b12ec308154b937ad118d69fe5) Signed-off-by: Andrej Valek Signed-off-by: Peter Marko Signed-off-by: Richard Purdie --- meta/conf/bitbake.conf | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/conf/bitbake.conf') diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf index 8daaaad615..475d6523bb 100644 --- a/meta/conf/bitbake.conf +++ b/meta/conf/bitbake.conf @@ -831,6 +831,7 @@ include conf/distro/defaultsetup.conf include conf/documentation.conf include conf/licenses.conf require conf/sanity.conf +require conf/cve-check-map.conf ################################################################## # Weak variables (usually to retain backwards compatibility) -- cgit v1.2.3-54-g00ecf