Re: [PATCH 2/2] xwayland: set status for CVE-2024-21886

[Benjamin Robin <benjamin.robin@bootlin.com>]

On Sunday, April 12, 2026 at 11:01 PM, Marko, Peter wrote:
> > From: Benjamin Robin <benjamin.robin@bootlin.com>
> > This should not be possible. With default configuration a manual
> > annotation cannot be overwritten. sbom-cve-check directly use the
> > annotation without any extra processing.
> 
> I wonder what I'm doing wrong when using this new code for the first time...
> When I got to the "new" CVE for ovmf, cve-metrics shows only CVE-2024-1298.
> In my local build, I get all the CVEs (which are se to fixed-version in the recipe).
> 
> RECIPE=ovmf; bitbake $RECIPE -c sbom_cve_check_recipe; jq -r '.package[] | select(.name == "'$RECIPE'") | .issue[]? | select(.status == "Unpatched") | .id' tmp/deploy/images/qemux86-64/$RECIPE-recipe-sbom.sbom-cve-check.yocto.json
> CVE-2014-4859
> CVE-2014-4860
> CVE-2014-8271
> CVE-2019-14553
> CVE-2019-14559
> CVE-2019-14562
> CVE-2019-14563
> CVE-2019-14575
> CVE-2019-14586
> CVE-2019-14587
> CVE-2024-1298
> 
> My local.conf is:
> DISTRO = "poky"
> INHERIT += "sbom-cve-check-recipe"
> SRCREV:pn-sbom-cve-check-update-cvelist-native = "82e18eb3051039642ed8ec0b8eb15ea27dbbf52c"
> include conf/distro/include/cve-extra-exclusions.inc

I still cannot reproduce your issue.
Could you share these 2 files (by email and compressed, and maybe only to me):
 - ovmf-recipe-sbom.spdx.json
 - ovmf-recipe-sbom.sbom-cve-check.yocto.json

If you also have a KAS configuration file of your current setup, this will
be great.

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com