On 2/14/21 11:51 PM, [email protected] wrote: > Hi, > > On Sun, Feb 14, 2021 at 11:20:27PM +0000, akuster wrote: >> I don't see the point in logging native, nativesdk etc. >> The bottom line is the BPN has the issue. > While I agree to some part and do alot of: > > $ cd build/tmp/deploy/cve > $ less $( grep -l Unpatched * | \ > egrep -v -- '-native|-nativesdk|-cross-|-crosssdk' ) We appear to generate a lot of redundant information. > > I do find that fixing build tooling CVEs is a good idea since > they downloads stuff from the Internet. > > Hence I'm not sure I like this filter. Maybe at least > rename CVE_CHECK_MANIFEST_FILTER to CVE_CHECK_FILTER_BUILD_TOOLS > which makes this a bit more clear. Yeah, I wasn't all the keen on the name either. Thanks for the input
thanks, Armin > > Cheers, > > -Mikko > >> Allow folks to filter out those other package name variations via >> CVE_CHECK_MANIFEST_FILTER >> >> Signed-off-by: Armin Kuster <[email protected]> >> --- >> meta/classes/cve-check.bbclass | 9 +++++++++ >> 1 file changed, 9 insertions(+) >> >> diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass >> index 112ee3379d3..0d33d5a530c 100644 >> --- a/meta/classes/cve-check.bbclass >> +++ b/meta/classes/cve-check.bbclass >> @@ -59,6 +59,7 @@ CVE_CHECK_LAYER_EXCLUDELIST ??= "" >> # Layers to be included >> CVE_CHECK_LAYER_INCLUDELIST ??= "" >> >> +CVE_CHECK_MANIFEST_FILTER ??="0" >> >> # set to "alphabetical" for version using single alphabetical character as >> increament release >> CVE_VERSION_SUFFIX ??= "" >> @@ -96,6 +97,13 @@ python do_cve_check () { >> """ >> >> if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")): >> + if d.getVar("CVE_CHECK_MANIFEST_FILTER") == "1": >> + # drop native, nativesdk, cross, etc >> + bpn = d.getVar("BPN") >> + pn = d.getVar("PN") >> + if bpn != pn: >> + return >> + >> try: >> patched_cves = get_patches_cves(d) >> except FileNotFoundError: >> @@ -164,6 +172,7 @@ def get_patches_cves(d): >> import re >> >> pn = d.getVar("PN") >> + >> cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") >> >> # Matches last CVE-1234-211432 in the file name, also if written >> -- >> 2.25.1 >> >> >>
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#148069): https://lists.openembedded.org/g/openembedded-core/message/148069 Mute This Topic: https://lists.openembedded.org/mt/80642628/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
