Re: [OE-core] [master] [PATCH] cve-check: Add provision to exclude classes

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Fri, Mar 15, 2024 at 07:52:00PM +0000, Dhairya Nagodra via lists.openembedded.org wrote:
> 
> 
> >-----Original Message-----
> >From: Ross Burton <Ross.Burton@arm.com>
> >Sent: Friday, March 15, 2024 9:39 PM
> >To: Dhairya Nagodra -X (dnagodra - E-INFO CHIPS INC at Cisco)
> ><dnagodra@cisco.com>
> >Cc: openembedded-core@lists.openembedded.org; xe-linux-external(mailer
> >list) <xe-linux-external@cisco.com>
> >Subject: Re: [OE-core] [master] [PATCH] cve-check: Add provision to exclude
> >classes
> >
> >On 3 Mar 2024, at 17:53, Dhairya Nagodra via lists.openembedded.org
> ><dnagodra=cisco.com@lists.openembedded.org> wrote:
> >>
> >> From: Dhairya Nagodra <dnagodra@cisco.com>
> >>
> >> - There are times when exluding a package that inherits a particular
> >> class/classes may be desired.
> >> - This provides the framework for that via the variable:
> >>  CVE_CHECK_CLASS_EXCLUDELIST
> >
> >What’s the use-case for this?  Note that you can control whether cve-check
> >runs per-layer already, if that’s useful.
> 
> Currently, the CVE report is generated for all packages associated with the build. 
> However, not all of them might be getting used in the target device.
> The package associated with native, nativesdk, cross classes are examples of such.
> This patch would provide a way to exclude these packages in the CVE report.
> So, if the variable is set like CVE_CHECK_CLASS_EXCLUDELIST = "native", 
> The report would not have the entries for these packages:
>  gnupg-native, nasm-native, binutils-native (and so on)
> 
> This is helpful when one wants to concentrate their CVE fixing efforts to the 
> specific packages going into the target device.

CVE check generates report summaries for all images already. Doesn't that cover this
usecase?

And many build tools end up talking to servers in the Internet so detecting
and fixing CVEs in them is also quite important.

Cheers,

-Mikko