From: Peter Marko <[email protected]> This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98 which adapts vex creation between function create_spdx where all changes were backported and funtion get_patched_cves where changes were not backported.
CVE patches were previously ignored as they cannot be decoded from CVE_STATUS variables and each caused a warning like: WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — missing or unknown CVE status Master branch uses fix-file-included for CVE patches however since cve-check-map.conf was not part of spdx-3.0 backport, closest one available (backported-patch) was implemented. Signed-off-by: Peter Marko <[email protected]> --- meta/lib/oe/spdx30_tasks.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 6b0aa137c4..8115088ab8 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -503,7 +503,13 @@ def create_spdx(d): if include_vex != "none": patched_cves = oe.cve_check.get_patched_cves(d) for cve_id in patched_cves: - mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id) + # decode_cve_status is decoding CVE_STATUS, so patch files need to be hardcoded + if cve_id in (d.getVarFlags("CVE_STATUS") or {}): + mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id) + else: + mapping = "Patched" + detail = "backported-patch" # fix-file-included is not available in scarthgap + description = None if not mapping or not detail: bb.warn(f"Skipping {cve_id} — missing or unknown CVE status")
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#226520): https://lists.openembedded.org/g/openembedded-core/message/226520 Mute This Topic: https://lists.openembedded.org/mt/116354841/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
