Hi, On Fri, Mar 15, 2024 at 07:52:00PM +0000, Dhairya Nagodra via lists.openembedded.org wrote: > > > >-----Original Message----- > >From: Ross Burton <[email protected]> > >Sent: Friday, March 15, 2024 9:39 PM > >To: Dhairya Nagodra -X (dnagodra - E-INFO CHIPS INC at Cisco) > ><[email protected]> > >Cc: [email protected]; xe-linux-external(mailer > >list) <[email protected]> > >Subject: Re: [OE-core] [master] [PATCH] cve-check: Add provision to exclude > >classes > > > >On 3 Mar 2024, at 17:53, Dhairya Nagodra via lists.openembedded.org > ><[email protected]> wrote: > >> > >> From: Dhairya Nagodra <[email protected]> > >> > >> - There are times when exluding a package that inherits a particular > >> class/classes may be desired. > >> - This provides the framework for that via the variable: > >> CVE_CHECK_CLASS_EXCLUDELIST > > > >What’s the use-case for this? Note that you can control whether cve-check > >runs per-layer already, if that’s useful. > > Currently, the CVE report is generated for all packages associated with the > build. > However, not all of them might be getting used in the target device. > The package associated with native, nativesdk, cross classes are examples of > such. > This patch would provide a way to exclude these packages in the CVE report. > So, if the variable is set like CVE_CHECK_CLASS_EXCLUDELIST = "native", > The report would not have the entries for these packages: > gnupg-native, nasm-native, binutils-native (and so on) > > This is helpful when one wants to concentrate their CVE fixing efforts to the > specific packages going into the target device.
CVE check generates report summaries for all images already. Doesn't that cover this usecase? And many build tools end up talking to servers in the Internet so detecting and fixing CVEs in them is also quite important. Cheers, -Mikko
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#197293): https://lists.openembedded.org/g/openembedded-core/message/197293 Mute This Topic: https://lists.openembedded.org/mt/104706824/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
