[Buildroot] [RFC PATCH 00/14] Add exportable vulnerability informations

[Thomas Perale via buildroot <buildroot@buildroot.org>]

In Buildroot, we can put the ignore CVEs entries in different
categories:

- Vulnerability fixed by a patch.
- Vulnerability ignored because the internal tooling detect it as a
  false positive
- Vulnerability ignored because the database is wrong or not up-to-date.
- Vulnerability ignored because it doesn't apply to Buildroot
  (platform/hardware specific, ...).
- Vulnerability ignored because Buildroot is using an upstream fixed
  version (based on a hash for instance) while the CPE metadata
  reference the latest known version.

Since the introduction of `_IGNORE_CVES` the justification for the
vulnerability were added as a comment on top of the ignored
vulnerability.

With the introduction of the rule for the `CVE:` trailer it's now
possible to distinguish the vulnerabilities that are patched from the
one that are not-applicable for another unknown reason.

This series add support to tag the remaining 'IGNORE_CVES' entry with a
set of information that can then be exported with 'show-info'.

This was discussed during the post-FOSDEM buildroot hackathon. The idea
of using OpenVex for the annotation format as in the future multiple
SBOM output format might be supported and OpenVex looked like a good
candidate for the base annotation without re-inventing our own format.

This RFC to discuss: 
 - The OpenVex annotation used and how we make them map to the Buildroot
   cases (see the doc change). I also provided some example of ignored
   entries and how I make them map to give more context. Not all the
   entries are mapped yet.
 - Should we consider another format ?
 - How I translate this format to CycloneDX analysis.

Still TODO:

- The CycloneDX translation needs to change as it depends on
  https://patchwork.ozlabs.org/project/buildroot/patch/20260624101340.80670-8-thomas.perale@mind.be/.
  The current implementation is a rough draft that is used only for
  testing
- The STATUS and DETAIL variables needs to be replicated for host
  packages.
- Add a test case that run 'make show-info-all |
  utils/generate-cyclonedx' and verify no "in_triage" analysis remains.
  This depends on the two previous TODOs.

Thomas Perale (14):
  docs/manual: add vulnerability status and justification
  utils/checkpackagelib/lib_mk.py: check _STATUS value is supported
  package/pkg-utils: show-info expose vuln details
  utils/generate-cyclonedx: support vulnerability details
  package/sox: add vulnerabilities details
  package/php: add vulnerability details
  package/mupdf: add vulnerabilities details
  package/python-pip: add detail to vulnerability
  package/luajit: add details to vulnerabilities
  package/libuci: add vulnerability details
  package/glibc: add vulnerability details
  package/freeradius-server: add vulnerabilities details
  package/flex: add vulnerability details
  package/clamav: add vulnerability details

 docs/manual/adding-packages-generic.adoc      | 35 ++++++++
 package/clamav/clamav.mk                      |  6 +-
 package/flex/flex.mk                          |  7 +-
 .../freeradius-server/freeradius-server.mk    |  7 +-
 package/glibc/glibc.mk                        | 32 ++++---
 package/libuci/libuci.mk                      |  3 +-
 package/luajit/luajit.mk                      | 15 ++--
 package/mupdf/mupdf.mk                        | 10 +--
 package/php/php.mk                            |  3 +-
 package/pkg-utils.mk                          | 19 +++++
 package/python-pip/python-pip.mk              |  5 +-
 package/sox/sox.mk                            | 41 ++++++---
 utils/checkpackagelib/lib_mk.py               | 22 +++++
 utils/generate-cyclonedx                      | 83 +++++++++++++++----
 14 files changed, 227 insertions(+), 61 deletions(-)

-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot