Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-31 Thread Geoffrey GIRY
Hello, Marta Rybczynska wrote: > Would it be possible to run it over the world build of oe-core and possibly > meta-oe ? I tried the following: The command `bibake -c cve_check world` reports the same CVE with and without the patch applied. I did test for oe-core alone, and found the same

Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-31 Thread Richard Purdie
On Fri, 2023-03-31 at 10:59 +0200, Alexandre Belloni via lists.openembedded.org wrote: > Hello Marta, > > On 31/03/2023 09:48:27+0200, Marta Rybczynska wrote: > > Hello Geoffrey, > > Would it be possible to run it over the world build of oe-core and possibly > > meta-oe ? > > > > It has already

Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-31 Thread Alexandre Belloni via lists.openembedded.org
Hello Marta, On 31/03/2023 09:48:27+0200, Marta Rybczynska wrote: > Hello Geoffrey, > Would it be possible to run it over the world build of oe-core and possibly > meta-oe ? > It has already run successfully and is already merged. > My build farm will be available only next week and I would

Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-31 Thread Marta Rybczynska
Hello Geoffrey, Would it be possible to run it over the world build of oe-core and possibly meta-oe ? My build farm will be available only next week and I would like to know if there are unexpected changes. Kind regards, Marta On Wed, Mar 29, 2023 at 3:31 PM Geoffrey GIRY wrote: > Hello

Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-29 Thread Geoffrey GIRY
Hello Marta, We only tested core-image-minimal and some recipes that use the update and release candidate formats (pX and -rcX) Geoffrey GIRY SMILE ECS - R Engineer Le mer. 29 mars 2023 à 06:45, Marta Rybczynska a écrit : > > On Tue, Mar 28, 2023 at 12:24 PM Geoffrey GIRY wrote: >> >> Fixes

Re: [OE-core] [PATCH] Fix cve-check false negative

2023-03-28 Thread Marta Rybczynska
On Tue, Mar 28, 2023 at 12:24 PM Geoffrey GIRY wrote: > Fixes [YOCTO #14127] > > NVD DB store version and update in the same value, separated by '_'. > The proposed patch check if the version from NVD DB contains a "_", > ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. > > Thank you

[OE-core] [PATCH] Fix cve-check false negative

2023-03-28 Thread Geoffrey GIRY
Fixes [YOCTO #14127] NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. Reviewed-by: Yoann CONGAL Signed-off-by: Geoffrey GIRY ---