On 10/29/18 3:13 PM, grygorii tertychnyi via Openembedded-core wrote:
> There are both "curl" and "libcurl" CPEs in NVD.
> All "curl" CVEs are now missed in the reports.
>
> Hence, switch "CVE_PRODUCT" to a space separated list.
> It is useful for recipes generating several packages,
> that have different product names in NVD.
>
> Signed-off-by: grygorii tertychnyi <[email protected]>
> ---
> meta/classes/cve-check.bbclass | 3 ++-
> meta/recipes-support/curl/curl_7.61.0.bb | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
> index 12ad3e5c5c..743bc08a4f 100644
> --- a/meta/classes/cve-check.bbclass
> +++ b/meta/classes/cve-check.bbclass
> @@ -190,7 +190,8 @@ def check_cves(d, patched_cves):
> # Write the faux CSV file to be used with cve-check-tool
> fd, faux = tempfile.mkstemp(prefix="cve-faux-")
> with os.fdopen(fd, "w") as f:
> - f.write("%s,%s,%s," % (bpn, pv, cves))
> + for pn in bpn.split():
> + f.write("%s,%s,%s,\n" % (pn, pv, cves))
> cmd.append(faux)
Please split this patch into two parts. the appear to be independent.
- armin
>
> output = subprocess.check_output(cmd).decode("utf-8")
> diff --git a/meta/recipes-support/curl/curl_7.61.0.bb
> b/meta/recipes-support/curl/curl_7.61.0.bb
> index 9b6406bbd0..53cfc4a518 100644
> --- a/meta/recipes-support/curl/curl_7.61.0.bb
> +++ b/meta/recipes-support/curl/curl_7.61.0.bb
> @@ -13,7 +13,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
> SRC_URI[md5sum] = "31d0a9f48dc796a7db351898a1e5058a"
> SRC_URI[sha256sum] =
> "5f6f336921cf5b84de56afbd08dfb70adeef2303751ffb3e570c936c6d656c9c"
>
> -CVE_PRODUCT = "libcurl"
> +CVE_PRODUCT = "curl libcurl"
> inherit autotools pkgconfig binconfig multilib_header
>
> PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} gnutls
> libidn proxy threaded-resolver verbose zlib"
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
