[yocto-autobuilder-helper][dunfell][PATCH] config.json: fix cvecheck iputils warning

[yocto-autobuilder-helper][dunfell][PATCH] config.json: fix cvecheck iputils warning

[Antonin Godard]

On Yocto Dunfell, an EOL version of Yocto, we consistently have the
following warning showed during the metrics job:

  WARNING: iputils-s20190709-r0 do_cve_check: iputils: Failed to compare
  s20190709 < 20250602 for CVE-2025-47268

This is because upstream stopped adding the leading "s" to their
version. Since we can't patch Yocto dunfell anymore, as a workaround set
the version of iputils so that the comparison passes. This makes the
cvecheck class show the following warning instead, which is expected:

  WARNING: iputils-20190709-r0 do_cve_check: Found unpatched CVE
  (CVE-2025-47268), for more information check
  /build/tmp/work/aarch64-poky-linux/iputils/20190709-r0/temp/cve.log

Which isn't shown on the Autobuilder thanks to CVE_CHECK_SHOW_WARNINGS =
'0'.

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
---
Test build (not pushed to metrics repo):
https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4111
---
 config.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/config.json b/config.json
index 94250e9..69674e9 100644
--- a/config.json
+++ b/config.json
@@ -853,6 +853,9 @@
             },
             "step2" : {
                 "shortname" : "CVE checks for meta",
+                "extravars" : [
+                    "PV:pn-iputils = '20190709'"
+                ],
                 "EXTRACMDS" : ["${SCRIPTSDIR}/run-cvecheck --metrics ../yocto-metrics --branch ${HELPERBRANCHNAME} --results ${HELPERRESULTSDIR}/../../patchmetrics --push"]
             },
             "step3" : {

---
base-commit: 59108a784c3d37f96f408d18993a3039a2e017bb
change-id: 20260923-fix-cvecheck-warning-fdunfell-409f249b5311

Re: [yocto-patches] [yocto-autobuilder-helper][dunfell][PATCH] config.json: fix cvecheck iputils warning

[Yoann Congal]

On Wed Sep 23, 2026 at 5:41 PM CEST, Antonin Godard via lists.yoctoproject.org wrote:
> On Yocto Dunfell, an EOL version of Yocto, we consistently have the
> following warning showed during the metrics job:
>
>   WARNING: iputils-s20190709-r0 do_cve_check: iputils: Failed to compare
>   s20190709 < 20250602 for CVE-2025-47268
>
> This is because upstream stopped adding the leading "s" to their
> version. Since we can't patch Yocto dunfell anymore, as a workaround set
> the version of iputils so that the comparison passes. This makes the
> cvecheck class show the following warning instead, which is expected:
>
>   WARNING: iputils-20190709-r0 do_cve_check: Found unpatched CVE
>   (CVE-2025-47268), for more information check
>   /build/tmp/work/aarch64-poky-linux/iputils/20190709-r0/temp/cve.log
>
> Which isn't shown on the Autobuilder thanks to CVE_CHECK_SHOW_WARNINGS =
> '0'.
>
> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
> ---
> Test build (not pushed to metrics repo):
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4111

Hello,

Thanks! (I had that on my todolist for the longest time but never got to
it)

Alternatively, since the metrics is the last thing we do actually
maintain, we could actually fix the recipe (if the fix is non intrusive,
obviously).

FYI, dunfell had 2 recent fixes for the metrics job.

Regards,
-- 
Yoann Congal
Smile ECS

Re: [yocto-patches] [yocto-autobuilder-helper][dunfell][PATCH] config.json: fix cvecheck iputils warning

[Antonin Godard]

On Thu Sep 24, 2026 at 8:51 AM CEST, Yoann Congal wrote:
> On Wed Sep 23, 2026 at 5:41 PM CEST, Antonin Godard via lists.yoctoproject.org wrote:
>> On Yocto Dunfell, an EOL version of Yocto, we consistently have the
>> following warning showed during the metrics job:
>>
>>   WARNING: iputils-s20190709-r0 do_cve_check: iputils: Failed to compare
>>   s20190709 < 20250602 for CVE-2025-47268
>>
>> This is because upstream stopped adding the leading "s" to their
>> version. Since we can't patch Yocto dunfell anymore, as a workaround set
>> the version of iputils so that the comparison passes. This makes the
>> cvecheck class show the following warning instead, which is expected:
>>
>>   WARNING: iputils-20190709-r0 do_cve_check: Found unpatched CVE
>>   (CVE-2025-47268), for more information check
>>   /build/tmp/work/aarch64-poky-linux/iputils/20190709-r0/temp/cve.log
>>
>> Which isn't shown on the Autobuilder thanks to CVE_CHECK_SHOW_WARNINGS =
>> '0'.
>>
>> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
>> ---
>> Test build (not pushed to metrics repo):
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4111
>
> Hello,
>
> Thanks! (I had that on my todolist for the longest time but never got to
> it)
>
> Alternatively, since the metrics is the last thing we do actually
> maintain, we could actually fix the recipe (if the fix is non intrusive,
> obviously).
>
> FYI, dunfell had 2 recent fixes for the metrics job.

Ha, I didn't dare sending a patch for dunfell :) Well, the same fix (setting PV to
"20190709") could be done in the recipe directly. If you consider that
non-invasive, I can send it today.

Antonin

Re: [yocto-patches] [yocto-autobuilder-helper][dunfell][PATCH] config.json: fix cvecheck iputils warning

[Yoann Congal]

Le 24 septembre 2026 09:37:55 GMT+02:00, Antonin Godard <antonin.godard@bootlin.com> a écrit :
>On Thu Sep 24, 2026 at 8:51 AM CEST, Yoann Congal wrote:
>> On Wed Sep 23, 2026 at 5:41 PM CEST, Antonin Godard via lists.yoctoproject.org wrote:
>>> On Yocto Dunfell, an EOL version of Yocto, we consistently have the
>>> following warning showed during the metrics job:
>>>
>>>   WARNING: iputils-s20190709-r0 do_cve_check: iputils: Failed to compare
>>>   s20190709 < 20250602 for CVE-2025-47268
>>>
>>> This is because upstream stopped adding the leading "s" to their
>>> version. Since we can't patch Yocto dunfell anymore, as a workaround set
>>> the version of iputils so that the comparison passes. This makes the
>>> cvecheck class show the following warning instead, which is expected:
>>>
>>>   WARNING: iputils-20190709-r0 do_cve_check: Found unpatched CVE
>>>   (CVE-2025-47268), for more information check
>>>   /build/tmp/work/aarch64-poky-linux/iputils/20190709-r0/temp/cve.log
>>>
>>> Which isn't shown on the Autobuilder thanks to CVE_CHECK_SHOW_WARNINGS =
>>> '0'.
>>>
>>> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
>>> ---
>>> Test build (not pushed to metrics repo):
>>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4111
>>
>> Hello,
>>
>> Thanks! (I had that on my todolist for the longest time but never got to
>> it)
>>
>> Alternatively, since the metrics is the last thing we do actually
>> maintain, we could actually fix the recipe (if the fix is non intrusive,
>> obviously).
>>
>> FYI, dunfell had 2 recent fixes for the metrics job.
>
>Ha, I didn't dare sending a patch for dunfell :) Well, the same fix (setting PV to
>"20190709") could be done in the recipe directly. If you consider that
>non-invasive, I can send it today.

That should be OK. Depending on the sorting rules, you might have to increase PE...

I'd rather do that instead of injecting PV via override.

Thanks!

>
>Antonin

Yoann Congal (Smile ECS)