>-----Original Message----- >From: Ross Burton <[email protected]> >Sent: Friday, March 15, 2024 9:39 PM >To: Dhairya Nagodra -X (dnagodra - E-INFO CHIPS INC at Cisco) ><[email protected]> >Cc: [email protected]; xe-linux-external(mailer >list) <[email protected]> >Subject: Re: [OE-core] [master] [PATCH] cve-check: Add provision to exclude >classes > >On 3 Mar 2024, at 17:53, Dhairya Nagodra via lists.openembedded.org ><[email protected]> wrote: >> >> From: Dhairya Nagodra <[email protected]> >> >> - There are times when exluding a package that inherits a particular >> class/classes may be desired. >> - This provides the framework for that via the variable: >> CVE_CHECK_CLASS_EXCLUDELIST > >What’s the use-case for this? Note that you can control whether cve-check >runs per-layer already, if that’s useful.
Currently, the CVE report is generated for all packages associated with the build. However, not all of them might be getting used in the target device. The package associated with native, nativesdk, cross classes are examples of such. This patch would provide a way to exclude these packages in the CVE report. So, if the variable is set like CVE_CHECK_CLASS_EXCLUDELIST = "native", The report would not have the entries for these packages: gnupg-native, nasm-native, binutils-native (and so on) This is helpful when one wants to concentrate their CVE fixing efforts to the specific packages going into the target device. Regards, Dhairya > >Ross
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#197249): https://lists.openembedded.org/g/openembedded-core/message/197249 Mute This Topic: https://lists.openembedded.org/mt/104706824/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
