On 15 Mar 2024, at 19:52, Dhairya Nagodra -X (dnagodra - E-INFO CHIPS INC at Cisco) <[email protected]> wrote: >> What’s the use-case for this? Note that you can control whether cve-check >> runs per-layer already, if that’s useful. > > Currently, the CVE report is generated for all packages associated with the > build. > However, not all of them might be getting used in the target device. > The package associated with native, nativesdk, cross classes are examples of > such. > This patch would provide a way to exclude these packages in the CVE report. > So, if the variable is set like CVE_CHECK_CLASS_EXCLUDELIST = "native", > The report would not have the entries for these packages: > gnupg-native, nasm-native, binutils-native (and so on)
For this specific use-case I’d suggest filtering the JSON to remove all -native entries. Also as Mikko said, a CVE in gcc-cross would absolutely need to be considered, so I’d not recommend ignoring all native recipes. Ross
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#197310): https://lists.openembedded.org/g/openembedded-core/message/197310 Mute This Topic: https://lists.openembedded.org/mt/104706824/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
