[wrynose][RFC PATCH 00/11] sbom-cve-check update

[wrynose][RFC PATCH 00/11] sbom-cve-check update

[Peter Marko]

This series updates sbom-cve-check tooling in wrynose to current master.
Unfortunately it shows that having cve-check tooling in upstream
components violates LTS patch acceptance policies.

In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0),
but also sbom-cve-check-update-nvd-native introduces new features
(which is actually the reason why this upgrade is wanted).
For now this should not be a big issue as all the dependencies are very
new and used exclusively in cve-check, however by time they may be used
in other recipes or tooling, too.

So I am sending this series as RFC to discuss future of CVE checking on
LTS branches.
* should we go with this series as is (possibly updating policy text)?
* or are we stuck with old code for next 3.5 years?
* or separate the tooling to meta-sbom-cve-check which would only have
  master branch to service all currently supported releases?
* or create mixins layer (to be also used by AB cve-metrics jobs)?
* or are there some other suggestions how to rework this series?

My preference would be to have cve-check aligned for all supported
releases (even scarthgap), so I would welcome opinions and discussion
on this topic.

Cc: Richard Purdie <richard.purdie@linuxfoundation.org>
Cc: Benjamin Robin <benjamin.robin@bootlin.com>
Cc: Yoann Congal <yoann.congal@smile.fr>
Cc: Paul Barker <paul@pbarker.dev>
Cc: Ross Burton <ross.burton@arm.com>

Alexander Kanavin (1):
  python3-shacl2code: upgrade 1.0.1 -> 1.1.0

Benjamin Robin (3):
  python3-sbom-cve-check: update to version 1.3.3
  sbom-cve-check-update-cvelist-native: update to version 2026-08-03
  sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011

Benjamin Robin (Schneider Electric) (4):
  python3-spdx-python-model: update from version 0.0.5 to 0.0.6
  python3-sbom-cve-check: update to version 1.3.2
  sbom-cve-check-update-cvelist-native: update to version 2026-06-24
  sbom-cve-check-update-nvd-native: update to version 2026.06.24-000003

Tim Orling (2):
  sbom-cve-check-update-cvelist-native: -> 2026-07-23
  sbom-cve-check-update-nvd-native: -> 2026.07.23-000007

Wang Mingyu (1):
  sbom-cve-check-update-nvd-native: upgrade 2026.05.07-000006 ->
    2026.06.09-000006

 ...{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} | 2 +-
 ...python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} | 2 +-
 ...-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +-
 ...07.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
 ...bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)
 rename meta/recipes-devtools/python/{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} (81%)
 rename meta/recipes-devtools/python/{python3-spdx-python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} (93%)
 rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.3.bb} (82%)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-05-07.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} (89%)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.05.07-000006.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} (89%)

[wrynose][RFC PATCH 01/11] sbom-cve-check-update-nvd-native: upgrade 2026.05.07-000006 -> 2026.06.09-000006

[Peter Marko]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: d33c73535229b5066901faedaaaca0aa6bbd99bf)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...bb => sbom-cve-check-update-nvd-native_2026.06.09-000006.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.05.07-000006.bb => sbom-cve-check-update-nvd-native_2026.06.09-000006.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
index 02446e30ce..2917c89e62 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "72d8841c8ad9083ebf6723063f275444ea0d76f9"
+SRCREV = "7ff4a0622bfdf5313c79635951112d2a45bbe9fd"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 02/11] python3-shacl2code: upgrade 1.0.1 -> 1.1.0

[Peter Marko]

From: Alexander Kanavin <alex@linutronix.de>

Add a patch to python3-spdx-python-model to support this release.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: f6557000abc90b0c3b7ca5b4560849e64425c853)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...e_1.0.1.bb => python3-shacl2code_1.1.0.bb} |  2 +-
 ...pdate-shacl2code-to-1.1.0-and-add-ke.patch | 41 +++++++++++++++++++
 .../python/python3-spdx-python-model_0.0.5.bb | 10 ++---
 3 files changed, 47 insertions(+), 6 deletions(-)
 rename meta/recipes-devtools/python/{python3-shacl2code_1.0.1.bb => python3-shacl2code_1.1.0.bb} (81%)
 create mode 100644 meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch

diff --git a/meta/recipes-devtools/python/python3-shacl2code_1.0.1.bb b/meta/recipes-devtools/python/python3-shacl2code_1.1.0.bb
similarity index 81%
rename from meta/recipes-devtools/python/python3-shacl2code_1.0.1.bb
rename to meta/recipes-devtools/python/python3-shacl2code_1.1.0.bb
index 904940926f..a9c8bec84f 100644
--- a/meta/recipes-devtools/python/python3-shacl2code_1.0.1.bb
+++ b/meta/recipes-devtools/python/python3-shacl2code_1.1.0.bb
@@ -5,7 +5,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=0582f358628f299f29c23bf5fb2f73c9"
 
 PYPI_PACKAGE = "shacl2code"
-SRC_URI[sha256sum] = "c856822b40c330452b8b31e94a658ad4595a5ef03cdb75ea432ea9c73d0cf7d9"
+SRC_URI[sha256sum] = "0f3a243c6482a0f95c5a793288d304908506b51b82dc6133de22be477cd75c24"
 
 inherit pypi python_hatchling
 
diff --git a/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch b/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch
new file mode 100644
index 0000000000..d9dc0a03c8
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch
@@ -0,0 +1,41 @@
+From b623473f634aebeb30028cc746fb7a3da4fb2ce3 Mon Sep 17 00:00:00 2001
+From: Arthit Suriyawongkul <arthit@gmail.com>
+Date: Sat, 6 Jun 2026 02:44:48 +0100
+Subject: [PATCH] pyproject.toml: Update shacl2code to 1.1.0 and add keywords
+ (#35)
+
+Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
+Upstream-Status: Backport [https://github.com/spdx/spdx-python-model/commit/2d7b71a7c8e6270a1c8795cdeb4f3dcd9393b3a9]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ pyproject.toml | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index c8b3e56..df011e8 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -8,6 +8,14 @@ authors = [
+     {name = "Joshua Watt", email = "JPEWhacker@gmail.com"},
+ ]
+ readme = "README.md"
++keywords = [
++    "spdx",
++    "sbom",
++    "spdx3",
++    "software-bill-of-materials",
++    "shacl2code",
++    "bindings",
++]
+ classifiers = [
+     "Development Status :: 4 - Beta",
+     "Intended Audience :: Developers",
+@@ -36,7 +44,7 @@ Issues = "https://github.com/spdx/spdx-python-model/issues"
+ requires = [
+     "hatchling >= 1.27.0",
+     "hatch-build-scripts >= 0.0.4",
+-    "shacl2code == 1.0.1",
++    "shacl2code == 1.1.0",
+ ]
+ build-backend = "hatchling.build"
+ 
diff --git a/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb b/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb
index c77bdffada..19d9bb815b 100644
--- a/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb
+++ b/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb
@@ -7,11 +7,11 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
 PYPI_PACKAGE = "spdx_python_model"
 SRC_URI[sha256sum] = "4bcf7c6e5e2e8f0b787ed4eb8fb519e2ed776e820cb6d9eb93e44e98eb92ca2d"
 
-SRC_URI += " \
-    https://spdx.org/rdf/3.0.1/spdx-context.jsonld;name=spdx1 \
-    https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl;name=spdx2 \
-    https://spdx.org/rdf/3.0.1/spdx-model.ttl;name=spdx3 \
-"
+SRC_URI += "https://spdx.org/rdf/3.0.1/spdx-context.jsonld;name=spdx1 \
+           https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl;name=spdx2 \
+           https://spdx.org/rdf/3.0.1/spdx-model.ttl;name=spdx3 \
+           file://0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch \
+           "
 
 SRC_URI[spdx1.sha256sum] = "c72b0928f094c83e5c127784edb1ebca2af74a104fcacc007c332b23cbc788bd"
 SRC_URI[spdx2.sha256sum] = "c6a54b51230eb2bf3b31302546af201f303e0b7931c1db404d7f5b72b6f863e6"

[wrynose][RFC PATCH 03/11] python3-spdx-python-model: update from version 0.0.5 to 0.0.6

[Peter Marko]

From: "Benjamin Robin (Schneider Electric)" <benjamin.robin@bootlin.com>

Drop the patch which should no longer be necessary. This is a partial
revert of f6557000abc90b0c3b7ca5b4560849e64425c853

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9b5c92cd6b8ef8a56ebc3815120fd4af5872173c)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...pdate-shacl2code-to-1.1.0-and-add-ke.patch | 41 -------------------
 ....bb => python3-spdx-python-model_0.0.6.bb} | 12 +++---
 2 files changed, 6 insertions(+), 47 deletions(-)
 delete mode 100644 meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch
 rename meta/recipes-devtools/python/{python3-spdx-python-model_0.0.5.bb => python3-spdx-python-model_0.0.6.bb} (72%)

diff --git a/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch b/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch
deleted file mode 100644
index d9dc0a03c8..0000000000
--- a/meta/recipes-devtools/python/python3-spdx-python-model/0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From b623473f634aebeb30028cc746fb7a3da4fb2ce3 Mon Sep 17 00:00:00 2001
-From: Arthit Suriyawongkul <arthit@gmail.com>
-Date: Sat, 6 Jun 2026 02:44:48 +0100
-Subject: [PATCH] pyproject.toml: Update shacl2code to 1.1.0 and add keywords
- (#35)
-
-Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
-Upstream-Status: Backport [https://github.com/spdx/spdx-python-model/commit/2d7b71a7c8e6270a1c8795cdeb4f3dcd9393b3a9]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- pyproject.toml | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/pyproject.toml b/pyproject.toml
-index c8b3e56..df011e8 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -8,6 +8,14 @@ authors = [
-     {name = "Joshua Watt", email = "JPEWhacker@gmail.com"},
- ]
- readme = "README.md"
-+keywords = [
-+    "spdx",
-+    "sbom",
-+    "spdx3",
-+    "software-bill-of-materials",
-+    "shacl2code",
-+    "bindings",
-+]
- classifiers = [
-     "Development Status :: 4 - Beta",
-     "Intended Audience :: Developers",
-@@ -36,7 +44,7 @@ Issues = "https://github.com/spdx/spdx-python-model/issues"
- requires = [
-     "hatchling >= 1.27.0",
-     "hatch-build-scripts >= 0.0.4",
--    "shacl2code == 1.0.1",
-+    "shacl2code == 1.1.0",
- ]
- build-backend = "hatchling.build"
- 
diff --git a/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb b/meta/recipes-devtools/python/python3-spdx-python-model_0.0.6.bb
similarity index 72%
rename from meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb
rename to meta/recipes-devtools/python/python3-spdx-python-model_0.0.6.bb
index 19d9bb815b..def12b2049 100644
--- a/meta/recipes-devtools/python/python3-spdx-python-model_0.0.5.bb
+++ b/meta/recipes-devtools/python/python3-spdx-python-model_0.0.6.bb
@@ -5,13 +5,13 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
 
 PYPI_PACKAGE = "spdx_python_model"
-SRC_URI[sha256sum] = "4bcf7c6e5e2e8f0b787ed4eb8fb519e2ed776e820cb6d9eb93e44e98eb92ca2d"
+SRC_URI[sha256sum] = "f1938eb08d08218278122849bba123b8993a0171e9b4f5ea6af7aeb71f3204d7"
 
-SRC_URI += "https://spdx.org/rdf/3.0.1/spdx-context.jsonld;name=spdx1 \
-           https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl;name=spdx2 \
-           https://spdx.org/rdf/3.0.1/spdx-model.ttl;name=spdx3 \
-           file://0001-pyproject.toml-Update-shacl2code-to-1.1.0-and-add-ke.patch \
-           "
+SRC_URI += " \
+    https://spdx.org/rdf/3.0.1/spdx-context.jsonld;name=spdx1 \
+    https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl;name=spdx2 \
+    https://spdx.org/rdf/3.0.1/spdx-model.ttl;name=spdx3 \
+"
 
 SRC_URI[spdx1.sha256sum] = "c72b0928f094c83e5c127784edb1ebca2af74a104fcacc007c332b23cbc788bd"
 SRC_URI[spdx2.sha256sum] = "c6a54b51230eb2bf3b31302546af201f303e0b7931c1db404d7f5b72b6f863e6"

[wrynose][RFC PATCH 04/11] python3-sbom-cve-check: update to version 1.3.2

[Peter Marko]

From: "Benjamin Robin (Schneider Electric)" <benjamin.robin@bootlin.com>

For details on this new release, see:
https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.2

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: cd6313d94ac221dc37c30ffec8c83b6c8d1deeff)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.2.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.1.bb => python3-sbom-cve-check_1.3.2.bb} (82%)

diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.1.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
similarity index 82%
rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.1.bb
rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
index 8120848a66..f14901e300 100644
--- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.1.bb
+++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
@@ -5,7 +5,7 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
 
 PYPI_PACKAGE = "sbom_cve_check"
-SRC_URI[sha256sum] = "675828b2f02f11620b7a229853a24d09264bf41161be5fbb80a92456f46a14e0"
+SRC_URI[sha256sum] = "0a7f07a0c6ce45d40adc6d311ddc25c4466f59bafcbce149b6fb3663791a5d89"
 
 inherit pypi python_hatchling
 

[wrynose][RFC PATCH 05/11] sbom-cve-check-update-cvelist-native: update to version 2026-06-24

[Peter Marko]

From: "Benjamin Robin (Schneider Electric)" <benjamin.robin@bootlin.com>

Update cvelistV5 to the CVE database from 2026-06-24.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: f7a706321eb783ad43d8d9666ea3536024cb5be8)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...07.bb => sbom-cve-check-update-cvelist-native_2026-06-24.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-05-07.bb => sbom-cve-check-update-cvelist-native_2026-06-24.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-05-07.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-05-07.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb
index 7670172c40..ca192bc9cf 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-05-07.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
 SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "cvelist"
 
-SRCREV = "dd0e93c75034d0167498174c886a56729edc44de"
+SRCREV = "966bddf787997b471325e065cae82702a60c64ff"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>.+)_baseline"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 06/11] sbom-cve-check-update-nvd-native: update to version 2026.06.24-000003

[Peter Marko]

From: "Benjamin Robin (Schneider Electric)" <benjamin.robin@bootlin.com>

Update fkie-cad/nvd-json-data-feeds to the CVE database from 2026-06-24.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: fba290297e9bbc8c6c4086e7784ece5d06dbd26d)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...bb => sbom-cve-check-update-nvd-native_2026.06.24-000003.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.06.09-000006.bb => sbom-cve-check-update-nvd-native_2026.06.24-000003.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb
index 2917c89e62..73d9e77692 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "7ff4a0622bfdf5313c79635951112d2a45bbe9fd"
+SRCREV = "11e62eba27133a54836b7a081d05ff96f72d879b"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 07/11] sbom-cve-check-update-cvelist-native: -> 2026-07-23

[Peter Marko]

From: Tim Orling <ticotimo@gmail.com>

The diff is quite large, but a partial comparison can be seen:
https://github.com/CVEProject/cvelistV5/compare/2026-06-24_baseline..2026-07-23_baseline

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 1323691ceab2a338c4d5b9c15624b8d22c472e7f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...24.bb => sbom-cve-check-update-cvelist-native_2026-07-23.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-06-24.bb => sbom-cve-check-update-cvelist-native_2026-07-23.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
index ca192bc9cf..0e664d89e0 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-06-24.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
 SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "cvelist"
 
-SRCREV = "966bddf787997b471325e065cae82702a60c64ff"
+SRCREV = "7a274ec07043f54c07d0a3b5c7fc89ba5793f023"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>.+)_baseline"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 08/11] sbom-cve-check-update-nvd-native: -> 2026.07.23-000007

[Peter Marko]

From: Tim Orling <ticotimo@gmail.com>

The diff is quite large, but a partial comparison can be seen:
https://github.com/fkie-cad/nvd-json-data-feeds/compare/v2026.06.24-000003..v2026.07.23-000007

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9d89b3b802bab144afa30e03b0411ae58232ef11)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...bb => sbom-cve-check-update-nvd-native_2026.07.23-000007.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.06.24-000003.bb => sbom-cve-check-update-nvd-native_2026.07.23-000007.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
index 73d9e77692..cf35b16923 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.24-000003.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "11e62eba27133a54836b7a081d05ff96f72d879b"
+SRCREV = "64a0cea215628d780438fba8bfe0f3300db1b702"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 09/11] python3-sbom-cve-check: update to version 1.3.3

[Peter Marko]

From: Benjamin Robin <benjamin.robin@bootlin.com>

For details on this new release, see:
https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.3

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 7feb4e30ba17a4b0eb37a1c6dde671d4491bd35d)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} (82%)

diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
similarity index 82%
rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
index f14901e300..2aca100569 100644
--- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
+++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
@@ -5,7 +5,7 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
 
 PYPI_PACKAGE = "sbom_cve_check"
-SRC_URI[sha256sum] = "0a7f07a0c6ce45d40adc6d311ddc25c4466f59bafcbce149b6fb3663791a5d89"
+SRC_URI[sha256sum] = "8b766be1ae92b4eceaa2f694dd4724e310886c6436f44267a6bbc6a7b81ab8b9"
 
 inherit pypi python_hatchling
 

[wrynose][RFC PATCH 10/11] sbom-cve-check-update-cvelist-native: update to version 2026-08-03

[Peter Marko]

From: Benjamin Robin <benjamin.robin@bootlin.com>

Update cvelistV5 to the CVE database from 2026-08-03.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 25e68deb8178f7021605a39fa85acea04a375372)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-cvelist-native_2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
index 0e664d89e0..aa21b06953 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
 SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "cvelist"
 
-SRCREV = "7a274ec07043f54c07d0a3b5c7fc89ba5793f023"
+SRCREV = "b160e6f2915ac726b29ee0689fc920f5016abef5"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>.+)_baseline"
 
 require sbom-cve-check-update-db.inc

[wrynose][RFC PATCH 11/11] sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011

[Peter Marko]

From: Benjamin Robin <benjamin.robin@bootlin.com>

Update fkie-cad/nvd-json-data-feeds to the CVE database from 2026.08.03.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 5928cf1985d65b5dc7a909df596d7ff91533fccd)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 ...bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.07.23-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
index cf35b16923..720b5ded0a 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "64a0cea215628d780438fba8bfe0f3300db1b702"
+SRCREV = "b9f52bb052695dac5cabbd58e049eaac73697161"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc

Re: [wrynose][RFC PATCH 00/11] sbom-cve-check update

[Paul Barker]

On Sat, 2026-08-08 at 12:51 +0200, Peter Marko wrote:
> This series updates sbom-cve-check tooling in wrynose to current master.
> Unfortunately it shows that having cve-check tooling in upstream
> components violates LTS patch acceptance policies.
> 
> In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0),
> but also sbom-cve-check-update-nvd-native introduces new features
> (which is actually the reason why this upgrade is wanted).
> For now this should not be a big issue as all the dependencies are very
> new and used exclusively in cve-check, however by time they may be used
> in other recipes or tooling, too.
> 
> So I am sending this series as RFC to discuss future of CVE checking on
> LTS branches.
> * should we go with this series as is (possibly updating policy text)?
> * or are we stuck with old code for next 3.5 years?
> * or separate the tooling to meta-sbom-cve-check which would only have
>   master branch to service all currently supported releases?
> * or create mixins layer (to be also used by AB cve-metrics jobs)?
> * or are there some other suggestions how to rework this series?
> 
> My preference would be to have cve-check aligned for all supported
> releases (even scarthgap), so I would welcome opinions and discussion
> on this topic.
> 
> Cc: Richard Purdie <richard.purdie@linuxfoundation.org>
> Cc: Benjamin Robin <benjamin.robin@bootlin.com>
> Cc: Yoann Congal <yoann.congal@smile.fr>
> Cc: Paul Barker <paul@pbarker.dev>
> Cc: Ross Burton <ross.burton@arm.com>

Hi Peter,

The TSC has discussed this series and is happy for sbom-cve-check to be
updated on wrynose. It's in line with the expectations we had when
wrynose was released, and the upstream maintainer is involved.

For scarthgap it's a different question. That still has the
cve-check.bbclass implementation instead of sbom-cve-check, this would
be whole new framework rather than a set of updates. I wonder if this
can be handled via an LTS mixin layer instead of a backport in OE-core?

Best regards,

-- 
Paul Barker

Re: [wrynose][RFC PATCH 00/11] sbom-cve-check update

[Benjamin Robin]

On Thursday, August 13, 2026 at 1:46 PM, Paul Barker wrote:
> On Sat, 2026-08-08 at 12:51 +0200, Peter Marko wrote:
> > This series updates sbom-cve-check tooling in wrynose to current master.
> > Unfortunately it shows that having cve-check tooling in upstream
> > components violates LTS patch acceptance policies.
> > 
> > In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0),
> > but also sbom-cve-check-update-nvd-native introduces new features
> > (which is actually the reason why this upgrade is wanted).
> > For now this should not be a big issue as all the dependencies are very
> > new and used exclusively in cve-check, however by time they may be used
> > in other recipes or tooling, too.
> > 
> > So I am sending this series as RFC to discuss future of CVE checking on
> > LTS branches.
> > * should we go with this series as is (possibly updating policy text)?
> > * or are we stuck with old code for next 3.5 years?
> > * or separate the tooling to meta-sbom-cve-check which would only have
> >   master branch to service all currently supported releases?
> > * or create mixins layer (to be also used by AB cve-metrics jobs)?
> > * or are there some other suggestions how to rework this series?
> > 
> > My preference would be to have cve-check aligned for all supported
> > releases (even scarthgap), so I would welcome opinions and discussion
> > on this topic.

Hello Peter,

Thank you for taking the time to create this series. I had been planning
to work on it, but I was a bit busy :) 

> 
> Hi Peter,
> 
> The TSC has discussed this series and is happy for sbom-cve-check to be
> updated on wrynose. It's in line with the expectations we had when
> wrynose was released, and the upstream maintainer is involved.
> 
> For scarthgap it's a different question. That still has the
> cve-check.bbclass implementation instead of sbom-cve-check, this would
> be whole new framework rather than a set of updates. I wonder if this
> can be handled via an LTS mixin layer instead of a backport in OE-core?

Hello Paul,

Technically, I think we could backport sbom-cve-check to scarthgap, but
indeed it still has the cve-check.bbclass implementation.                                                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                                                            
sbom-cve-check can be run outside of Yocto, but if you want it integrated                                                                                                                                                                                                                                              
into Yocto, there's already a layer for that:                                                                                                                                                                                                                                                                          
https://github.com/bootlin/meta-sbom-cve-check                                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                                                                            
However, I need to update it to version 1.3.3.

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

RE: [wrynose][RFC PATCH 00/11] sbom-cve-check update

[Marko, Peter]

> -----Original Message-----
> From: Benjamin Robin <benjamin.robin@bootlin.com>
> Sent: Thursday, August 13, 2026 1:56 PM
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> openembedded-core@lists.openembedded.org; Paul Barker <paul@pbarker.dev>
> Cc: Richard Purdie <richard.purdie@linuxfoundation.org>; Yoann Congal
> <yoann.congal@smile.fr>; Ross Burton <ross.burton@arm.com>
> Subject: Re: [wrynose][RFC PATCH 00/11] sbom-cve-check update
> 
> On Thursday, August 13, 2026 at 1:46 PM, Paul Barker wrote:
> > On Sat, 2026-08-08 at 12:51 +0200, Peter Marko wrote:
> > > This series updates sbom-cve-check tooling in wrynose to current master.
> > > Unfortunately it shows that having cve-check tooling in upstream
> > > components violates LTS patch acceptance policies.
> > >
> > > In this case the most visible is python3-shacl2code (1.0.1 -> 1.1.0),
> > > but also sbom-cve-check-update-nvd-native introduces new features
> > > (which is actually the reason why this upgrade is wanted).
> > > For now this should not be a big issue as all the dependencies are very
> > > new and used exclusively in cve-check, however by time they may be used
> > > in other recipes or tooling, too.
> > >
> > > So I am sending this series as RFC to discuss future of CVE checking on
> > > LTS branches.
> > > * should we go with this series as is (possibly updating policy text)?
> > > * or are we stuck with old code for next 3.5 years?
> > > * or separate the tooling to meta-sbom-cve-check which would only have
> > >   master branch to service all currently supported releases?
> > > * or create mixins layer (to be also used by AB cve-metrics jobs)?
> > > * or are there some other suggestions how to rework this series?
> > >
> > > My preference would be to have cve-check aligned for all supported
> > > releases (even scarthgap), so I would welcome opinions and discussion
> > > on this topic.
> 
> Hello Peter,
> 
> Thank you for taking the time to create this series. I had been planning
> to work on it, but I was a bit busy :)
> 
> >
> > Hi Peter,
> >
> > The TSC has discussed this series and is happy for sbom-cve-check to be
> > updated on wrynose. It's in line with the expectations we had when
> > wrynose was released, and the upstream maintainer is involved.
> >
> > For scarthgap it's a different question. That still has the
> > cve-check.bbclass implementation instead of sbom-cve-check, this would
> > be whole new framework rather than a set of updates. I wonder if this
> > can be handled via an LTS mixin layer instead of a backport in OE-core?

Paul,

as the meta-sbom-cve-check layer shows, sbom-cve-check can co-exist with the old cve-check.
It does not have to be the super-invasive with breaking change.

So in theory it should be pretty easy to copy 3 classes and bunch of support recipes.
But I'm also fine with having an external layer for that.

Question is if Yocto project would also switch cve-metrics to the sbom-cve-check.
That would of course highly increase the open CVE numbers but would also help identify missing CVE fixes.

> 
> Hello Paul,
> 
> Technically, I think we could backport sbom-cve-check to scarthgap, but
> indeed it still has the cve-check.bbclass implementation.
> 
> sbom-cve-check can be run outside of Yocto, but if you want it integrated
> into Yocto, there's already a layer for that:
> https://github.com/bootlin/meta-sbom-cve-check

Benjamin,

This is super cool.
However, cve-metrics uses sbom-cve-check-recipe, which is not part of this layer.
When updating, please consider adding it.

Peter

> 
> However, I need to update it to version 1.3.3.
> 
> --
> Benjamin Robin, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
> 
>