Hello Paul, Since this was accepted within TSC, can this be picked to wrynose now? Or do I have to resend this series without RFC prefix?
Thanks, Peter > -----Original Message----- > From: Paul Barker <[email protected]> > Sent: Thursday, August 13, 2026 1:46 PM > To: Marko, Peter (FT D EU SK BFS1) <[email protected]>; > [email protected] > Cc: Richard Purdie <[email protected]>; Benjamin Robin > <[email protected]>; Yoann Congal <[email protected]>; Ross > Burton <[email protected]> > Subject: Re: [wrynose][RFC PATCH 00/11] sbom-cve-check update > > On Sat, 2026-08-08 at 12:51 +0200, Peter Marko wrote: > > This series updates sbom-cve-check tooling in wrynose to current master. > > Unfortunately it shows that having cve-check tooling in upstream > > components violates LTS patch acceptance policies. > > > > In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0), > > but also sbom-cve-check-update-nvd-native introduces new features > > (which is actually the reason why this upgrade is wanted). > > For now this should not be a big issue as all the dependencies are very > > new and used exclusively in cve-check, however by time they may be used > > in other recipes or tooling, too. > > > > So I am sending this series as RFC to discuss future of CVE checking on > > LTS branches. > > * should we go with this series as is (possibly updating policy text)? > > * or are we stuck with old code for next 3.5 years? > > * or separate the tooling to meta-sbom-cve-check which would only have > > master branch to service all currently supported releases? > > * or create mixins layer (to be also used by AB cve-metrics jobs)? > > * or are there some other suggestions how to rework this series? > > > > My preference would be to have cve-check aligned for all supported > > releases (even scarthgap), so I would welcome opinions and discussion > > on this topic. > > > > Cc: Richard Purdie <[email protected]> > > Cc: Benjamin Robin <[email protected]> > > Cc: Yoann Congal <[email protected]> > > Cc: Paul Barker <[email protected]> > > Cc: Ross Burton <[email protected]> > > Hi Peter, > > The TSC has discussed this series and is happy for sbom-cve-check to be > updated on wrynose. It's in line with the expectations we had when > wrynose was released, and the upstream maintainer is involved. > > For scarthgap it's a different question. That still has the > cve-check.bbclass implementation instead of sbom-cve-check, this would > be whole new framework rather than a set of updates. I wonder if this > can be handled via an LTS mixin layer instead of a backport in OE-core? > > Best regards, > > -- > Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245704): https://lists.openembedded.org/g/openembedded-core/message/245704 Mute This Topic: https://lists.openembedded.org/mt/120655242/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
