This series updates sbom-cve-check tooling in wrynose to current master. Unfortunately it shows that having cve-check tooling in upstream components violates LTS patch acceptance policies.
In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0), but also sbom-cve-check-update-nvd-native introduces new features (which is actually the reason why this upgrade is wanted). For now this should not be a big issue as all the dependencies are very new and used exclusively in cve-check, however by time they may be used in other recipes or tooling, too. So I am sending this series as RFC to discuss future of CVE checking on LTS branches. * should we go with this series as is (possibly updating policy text)? * or are we stuck with old code for next 3.5 years? * or separate the tooling to meta-sbom-cve-check which would only have master branch to service all currently supported releases? * or create mixins layer (to be also used by AB cve-metrics jobs)? * or are there some other suggestions how to rework this series? My preference would be to have cve-check aligned for all supported releases (even scarthgap), so I would welcome opinions and discussion on this topic. Cc: Richard Purdie <[email protected]> Cc: Benjamin Robin <[email protected]> Cc: Yoann Congal <[email protected]> Cc: Paul Barker <[email protected]> Cc: Ross Burton <[email protected]> Alexander Kanavin (1): python3-shacl2code: upgrade 1.0.1 -> 1.1.0 Benjamin Robin (3): python3-sbom-cve-check: update to version 1.3.3 sbom-cve-check-update-cvelist-native: update to version 2026-08-03 sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011 Benjamin Robin (Schneider Electric) (4): python3-spdx-python-model: update from version 0.0.5 to 0.0.6 python3-sbom-cve-check: update to version 1.3.2 sbom-cve-check-update-cvelist-native: update to version 2026-06-24 sbom-cve-check-update-nvd-native: update to version 2026.06.24-000003 Tim Orling (2): sbom-cve-check-update-cvelist-native: -> 2026-07-23 sbom-cve-check-update-nvd-native: -> 2026.07.23-000007 Wang Mingyu (1): sbom-cve-check-update-nvd-native: upgrade 2026.05.07-000006 -> 2026.06.09-000006 ...{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} | 2 +- ...python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} | 2 +- ...-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +- ...07.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +- ...bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-devtools/python/{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} (81%) rename meta/recipes-devtools/python/{python3-spdx-python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} (93%) rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.3.bb} (82%) rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-05-07.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} (89%) rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.05.07-000006.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} (89%)
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243037): https://lists.openembedded.org/g/openembedded-core/message/243037 Mute This Topic: https://lists.openembedded.org/mt/120655242/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
