* [PATCH] bolt: disable CVE checking for this recipe
@ 2023-09-29 17:07 Jeffrey Pautler
2023-10-02 9:22 ` [oe] " Mikko Rapeli
0 siblings, 1 reply; 6+ messages in thread
From: Jeffrey Pautler @ 2023-09-29 17:07 UTC (permalink / raw)
To: openembedded-devel; +Cc: Jeffrey Pautler
This bolt product does not currently have an entry in the CVE database.
However, the default cve-check logic that maps recipes to products in
the CVE database is incorrectly matching this package to a different
bolt product made by bolt-cms. As a result, CVE checking incorrectly
reports CVEs for that product for this package.
Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
---
meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
index b6ad6337c..583cc6378 100644
--- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
+++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
@@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
S = "${WORKDIR}/git"
+CVE_CHECK_SKIP_RECIPE = "${PN}"
+
inherit cmake pkgconfig meson features_check
FILES:${PN} += "${datadir}/dbus-1/* \
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [oe] [PATCH] bolt: disable CVE checking for this recipe
2023-09-29 17:07 [PATCH] bolt: disable CVE checking for this recipe Jeffrey Pautler
@ 2023-10-02 9:22 ` Mikko Rapeli
2023-10-02 15:53 ` Alex Stewart
0 siblings, 1 reply; 6+ messages in thread
From: Mikko Rapeli @ 2023-10-02 9:22 UTC (permalink / raw)
To: Jeffrey Pautler; +Cc: openembedded-devel
Hi,
On Fri, Sep 29, 2023 at 12:07:31PM -0500, Jeffrey Pautler wrote:
> This bolt product does not currently have an entry in the CVE database.
> However, the default cve-check logic that maps recipes to products in
> the CVE database is incorrectly matching this package to a different
> bolt product made by bolt-cms. As a result, CVE checking incorrectly
> reports CVEs for that product for this package.
>
> Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
> ---
> meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> index b6ad6337c..583cc6378 100644
> --- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> +++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> @@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
>
> S = "${WORKDIR}/git"
>
> +CVE_CHECK_SKIP_RECIPE = "${PN}"
I think this is wrong and dangerous for anyone who in the future tries to use
cve checker for this recipe. Instead, set the CVE product with vendor correctly
so that other products/vendors don't mix the results? Hopefully any new CVEs
in the future will set the same vendor and product.
Cheers,
-Mikko
> inherit cmake pkgconfig meson features_check
>
> FILES:${PN} += "${datadir}/dbus-1/* \
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#105252): https://lists.openembedded.org/g/openembedded-devel/message/105252
> Mute This Topic: https://lists.openembedded.org/mt/101662068/7159507
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [mikko.rapeli@linaro.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [oe] [PATCH] bolt: disable CVE checking for this recipe
2023-10-02 9:22 ` [oe] " Mikko Rapeli
@ 2023-10-02 15:53 ` Alex Stewart
2023-10-02 16:06 ` Khem Raj
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Alex Stewart @ 2023-10-02 15:53 UTC (permalink / raw)
To: mikko.rapeli, Jeffrey Pautler; +Cc: openembedded-devel
On 10/2/23 05:22, Mikko Rapeli via lists.openembedded.org wrote:
> Hi,
>
> On Fri, Sep 29, 2023 at 12:07:31PM -0500, Jeffrey Pautler wrote:
>> This bolt product does not currently have an entry in the CVE database.
>> However, the default cve-check logic that maps recipes to products in
>> the CVE database is incorrectly matching this package to a different
>> bolt product made by bolt-cms. As a result, CVE checking incorrectly
>> reports CVEs for that product for this package.
>>
>> Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
>> ---
>> meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
>> index b6ad6337c..583cc6378 100644
>> --- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
>> +++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
>> @@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
>>
>> S = "${WORKDIR}/git"
>>
>> +CVE_CHECK_SKIP_RECIPE = "${PN}"
> I think this is wrong and dangerous for anyone who in the future tries to use
> cve checker for this recipe. Instead, set the CVE product with vendor correctly
> so that other products/vendors don't mix the results? Hopefully any new CVEs
> in the future will set the same vendor and product.
Are you suggesting that he set the string to something like...
`cpe:*:a:freedesktop:bolt:*`
on the hopes that, if the Free Desktop folks open a CPE in the future,
that it will match?
>
> Cheers,
>
> -Mikko
>
>> inherit cmake pkgconfig meson features_check
>>
>> FILES:${PN} += "${datadir}/dbus-1/* \
>> --
>> 2.34.1
>>
>>
>>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#105303): https://lists.openembedded.org/g/openembedded-devel/message/105303
> Mute This Topic: https://lists.openembedded.org/mt/101662068/3616788
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [alex.stewart@ni.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
--
Alex Stewart
Software Engineer - NI Real-Time OS
NI (National Instruments)
alex.stewart@ni.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [oe] [PATCH] bolt: disable CVE checking for this recipe
2023-10-02 15:53 ` Alex Stewart
@ 2023-10-02 16:06 ` Khem Raj
2023-10-02 18:14 ` Marta Rybczynska
2023-10-03 4:54 ` Mikko Rapeli
2 siblings, 0 replies; 6+ messages in thread
From: Khem Raj @ 2023-10-02 16:06 UTC (permalink / raw)
To: Alex Stewart; +Cc: Jeffrey Pautler, mikko.rapeli, openembedded-devel
[-- Attachment #1: Type: text/plain, Size: 2565 bytes --]
If we want to use a not yet Defined value then it would be good to inform
upstream about the issue and also add a comment next to the definition so
we can correct it in future
On Mon, Oct 2, 2023 at 8:53 AM Alex Stewart <alex.stewart@ni.com> wrote:
>
>
> On 10/2/23 05:22, Mikko Rapeli via lists.openembedded.org wrote:
> > Hi,
> >
> > On Fri, Sep 29, 2023 at 12:07:31PM -0500, Jeffrey Pautler wrote:
> >> This bolt product does not currently have an entry in the CVE database.
> >> However, the default cve-check logic that maps recipes to products in
> >> the CVE database is incorrectly matching this package to a different
> >> bolt product made by bolt-cms. As a result, CVE checking incorrectly
> >> reports CVEs for that product for this package.
> >>
> >> Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
> >> ---
> >> meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
> >> 1 file changed, 2 insertions(+)
> >>
> >> diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> index b6ad6337c..583cc6378 100644
> >> --- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> +++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> @@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
> >>
> >> S = "${WORKDIR}/git"
> >>
> >> +CVE_CHECK_SKIP_RECIPE = "${PN}"
> > I think this is wrong and dangerous for anyone who in the future tries
> to use
> > cve checker for this recipe. Instead, set the CVE product with vendor
> correctly
> > so that other products/vendors don't mix the results? Hopefully any new
> CVEs
> > in the future will set the same vendor and product.
>
> Are you suggesting that he set the string to something like...
> `cpe:*:a:freedesktop:bolt:*`
>
> on the hopes that, if the Free Desktop folks open a CPE in the future,
> that it will match?
>
> >
> > Cheers,
> >
> > -Mikko
> >
> >> inherit cmake pkgconfig meson features_check
> >>
> >> FILES:${PN} += "${datadir}/dbus-1/* \
> >> --
> >> 2.34.1
> >>
> >>
> >>
> >
> >
> >
>
> --
> Alex Stewart
> Software Engineer - NI Real-Time OS
> NI (National Instruments)
>
> alex.stewart@ni.com
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#105305):
> https://lists.openembedded.org/g/openembedded-devel/message/105305
> Mute This Topic: https://lists.openembedded.org/mt/101662068/1997914
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [
> raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
[-- Attachment #2: Type: text/html, Size: 4387 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [oe] [PATCH] bolt: disable CVE checking for this recipe
2023-10-02 15:53 ` Alex Stewart
2023-10-02 16:06 ` Khem Raj
@ 2023-10-02 18:14 ` Marta Rybczynska
2023-10-03 4:54 ` Mikko Rapeli
2 siblings, 0 replies; 6+ messages in thread
From: Marta Rybczynska @ 2023-10-02 18:14 UTC (permalink / raw)
To: Alex Stewart; +Cc: Mikko Rapeli, Jeffrey Pautler, OpenEmbedded Devel List
[-- Attachment #1: Type: text/plain, Size: 1776 bytes --]
On Mon, 2 Oct 2023, 17:53 Alex Stewart, <alex.stewart@ni.com> wrote:
>
>
> On 10/2/23 05:22, Mikko Rapeli via lists.openembedded.org wrote:
> > Hi,
> >
> > On Fri, Sep 29, 2023 at 12:07:31PM -0500, Jeffrey Pautler wrote:
> >> This bolt product does not currently have an entry in the CVE database.
> >> However, the default cve-check logic that maps recipes to products in
> >> the CVE database is incorrectly matching this package to a different
> >> bolt product made by bolt-cms. As a result, CVE checking incorrectly
> >> reports CVEs for that product for this package.
> >>
> >> Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
> >> ---
> >> meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
> >> 1 file changed, 2 insertions(+)
> >>
> >> diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> index b6ad6337c..583cc6378 100644
> >> --- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> +++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> >> @@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
> >>
> >> S = "${WORKDIR}/git"
> >>
> >> +CVE_CHECK_SKIP_RECIPE = "${PN}"
> > I think this is wrong and dangerous for anyone who in the future tries
> to use
> > cve checker for this recipe. Instead, set the CVE product with vendor
> correctly
> > so that other products/vendors don't mix the results? Hopefully any new
> CVEs
> > in the future will set the same vendor and product.
>
> Are you suggesting that he set the string to something like...
> `cpe:*:a:freedesktop:bolt:*`
>
> on the hopes that, if the Free Desktop folks open a CPE in the future,
> that it will match?
>
Or you can ignore CVEs that are badly assigned to this project. That works
if there is a manageable number.
Kind regards,
Marta
>
[-- Attachment #2: Type: text/html, Size: 3192 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [oe] [PATCH] bolt: disable CVE checking for this recipe
2023-10-02 15:53 ` Alex Stewart
2023-10-02 16:06 ` Khem Raj
2023-10-02 18:14 ` Marta Rybczynska
@ 2023-10-03 4:54 ` Mikko Rapeli
2 siblings, 0 replies; 6+ messages in thread
From: Mikko Rapeli @ 2023-10-03 4:54 UTC (permalink / raw)
To: Alex Stewart; +Cc: Jeffrey Pautler, openembedded-devel
Hi,
On Mon, Oct 02, 2023 at 11:53:42AM -0400, Alex Stewart wrote:
> On 10/2/23 05:22, Mikko Rapeli via lists.openembedded.org wrote:
> > Hi,
> >
> > On Fri, Sep 29, 2023 at 12:07:31PM -0500, Jeffrey Pautler wrote:
> > > This bolt product does not currently have an entry in the CVE database.
> > > However, the default cve-check logic that maps recipes to products in
> > > the CVE database is incorrectly matching this package to a different
> > > bolt product made by bolt-cms. As a result, CVE checking incorrectly
> > > reports CVEs for that product for this package.
> > >
> > > Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com>
> > > ---
> > > meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb | 2 ++
> > > 1 file changed, 2 insertions(+)
> > >
> > > diff --git a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> > > index b6ad6337c..583cc6378 100644
> > > --- a/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> > > +++ b/meta-oe/recipes-bsp/bolt/bolt_0.9.5.bb
> > > @@ -12,6 +12,8 @@ SRCREV = "5a8a5866a847561566499847d46a97c612b4e6dd"
> > > S = "${WORKDIR}/git"
> > > +CVE_CHECK_SKIP_RECIPE = "${PN}"
> > I think this is wrong and dangerous for anyone who in the future tries to use
> > cve checker for this recipe. Instead, set the CVE product with vendor correctly
> > so that other products/vendors don't mix the results? Hopefully any new CVEs
> > in the future will set the same vendor and product.
>
> Are you suggesting that he set the string to something like...
> `cpe:*:a:freedesktop:bolt:*`
>
> on the hopes that, if the Free Desktop folks open a CPE in the future, that
> it will match?
Yes, if other Freedesktop projects have used these before.
Cheers,
-Mikko
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-10-03 4:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-29 17:07 [PATCH] bolt: disable CVE checking for this recipe Jeffrey Pautler
2023-10-02 9:22 ` [oe] " Mikko Rapeli
2023-10-02 15:53 ` Alex Stewart
2023-10-02 16:06 ` Khem Raj
2023-10-02 18:14 ` Marta Rybczynska
2023-10-03 4:54 ` Mikko Rapeli
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.