Removes VEX statements from packages. These are no longer necessary since the VEX data is now attached to the recipes, which significantly reduces the duplication of the data, and thus the size of the SPDX output files.
Signed-off-by: Joshua Watt <[email protected]> --- meta/lib/oe/spdx30_tasks.py | 72 ------------------------------------- 1 file changed, 72 deletions(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index aec47d4f81..5b651900c4 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -768,31 +768,6 @@ def create_spdx(d): debug_source_ids = set() source_hash_cache = {} - # Collect all VEX statements from the recipe - vex_statements = {} - vex_patches = {} - for rel in recipe_objset.foreach_filter( - oe.spdx30.Relationship, - relationshipType=oe.spdx30.RelationshipType.hasAssociatedVulnerability, - ): - for cve in rel.to: - vex_statements[cve] = [] - vex_patches[cve] = [] - - for cve in vex_statements.keys(): - for rel in recipe_objset.foreach_filter( - oe.spdx30.security_VexVulnAssessmentRelationship, - from_=cve, - ): - vex_statements[cve].append(rel) - if rel.relationshipType == oe.spdx30.RelationshipType.fixedIn: - for patch_rel in recipe_objset.foreach_filter( - oe.spdx30.Relationship, - relationshipType=oe.spdx30.RelationshipType.patchedBy, - from_=rel, - ): - vex_patches[cve].extend(patch_rel.to) - # Write out the package SPDX data now. It is not complete as we cannot # write the runtime data, so write it to a staging area and a later task # will write out the final collection @@ -931,53 +906,6 @@ def create_spdx(d): [oe.sbom30.get_element_link_id(concluded_spdx_license)], ) - # Copy CVEs from recipe - if vex_statements: - pkg_objset.new_relationship( - [spdx_package], - oe.spdx30.RelationshipType.hasAssociatedVulnerability, - sorted( - oe.sbom30.get_element_link_id(cve) - for cve in vex_statements.keys() - ), - ) - - for cve, vexes in vex_statements.items(): - for vex in vexes: - if vex.relationshipType == oe.spdx30.RelationshipType.fixedIn: - spdx_vex = pkg_objset.new_vex_patched_relationship( - [oe.sbom30.get_element_link_id(cve)], [spdx_package] - ) - if vex_patches[cve]: - pkg_objset.new_scoped_relationship( - spdx_vex, - oe.spdx30.RelationshipType.patchedBy, - oe.spdx30.LifecycleScopeType.build, - [ - oe.sbom30.get_element_link_id(p) - for p in vex_patches[cve] - ], - ) - - elif vex.relationshipType == oe.spdx30.RelationshipType.affects: - pkg_objset.new_vex_unpatched_relationship( - [oe.sbom30.get_element_link_id(cve)], [spdx_package] - ) - elif ( - vex.relationshipType == oe.spdx30.RelationshipType.doesNotAffect - ): - spdx_vex = pkg_objset.new_vex_ignored_relationship( - [oe.sbom30.get_element_link_id(cve)], - [spdx_package], - impact_statement=vex.security_impactStatement, - ) - - if vex.security_justificationType: - for v in spdx_vex: - v.security_justificationType = ( - vex.security_justificationType - ) - bb.debug(1, "Adding package files to SPDX for package %s" % pkg_name) package_files = add_package_files( d, -- 2.53.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#233397): https://lists.openembedded.org/g/openembedded-core/message/233397 Mute This Topic: https://lists.openembedded.org/mt/118382781/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
