Re: [OE-core] [[PATCH] cve-check.bbclass: allow skiping non pbn

["akuster" <akuster808@gmail.com>]

On 2/14/21 11:51 PM, Mikko.Rapeli@bmw.de wrote:
> Hi,
>
> On Sun, Feb 14, 2021 at 11:20:27PM +0000, akuster wrote:
>> I don't see the point in logging native, nativesdk etc.
>> The bottom line is the BPN has the issue.
> While I agree to some part and do alot of:
>
> $ cd build/tmp/deploy/cve
> $ less $( grep -l Unpatched * | \
> egrep -v -- '-native|-nativesdk|-cross-|-crosssdk' )
We appear to generate a lot of redundant information.
>
> I do find that fixing build tooling CVEs is a good idea since
> they downloads stuff from the Internet.
>
> Hence I'm not sure I like this filter. Maybe at least
> rename CVE_CHECK_MANIFEST_FILTER to CVE_CHECK_FILTER_BUILD_TOOLS
> which makes this a bit more clear.
Yeah, I wasn't all the keen on the name either.  Thanks for the input

thanks,
Armin
>
> Cheers,
>
> -Mikko
>
>> Allow folks to filter out those other package name variations via
>> CVE_CHECK_MANIFEST_FILTER
>>
>> Signed-off-by: Armin Kuster <akuster808@gmail.com>
>> ---
>>  meta/classes/cve-check.bbclass | 9 +++++++++
>>  1 file changed, 9 insertions(+)
>>
>> diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
>> index 112ee3379d3..0d33d5a530c 100644
>> --- a/meta/classes/cve-check.bbclass
>> +++ b/meta/classes/cve-check.bbclass
>> @@ -59,6 +59,7 @@ CVE_CHECK_LAYER_EXCLUDELIST ??= ""
>>  # Layers to be included 
>>  CVE_CHECK_LAYER_INCLUDELIST ??= ""
>>
>> +CVE_CHECK_MANIFEST_FILTER ??="0"
>>
>>  # set to "alphabetical" for version using single alphabetical character as increament release
>>  CVE_VERSION_SUFFIX ??= ""
>> @@ -96,6 +97,13 @@ python do_cve_check () {
>>      """
>>
>>      if os.path.exists(d.getVar("CVE_CHECK_DB_FILE")):
>> +        if d.getVar("CVE_CHECK_MANIFEST_FILTER") == "1":
>> +            # drop native, nativesdk, cross, etc
>> +            bpn = d.getVar("BPN")
>> +            pn = d.getVar("PN")
>> +            if bpn != pn:
>> +               return
>> +
>>          try:
>>              patched_cves = get_patches_cves(d)
>>          except FileNotFoundError:
>> @@ -164,6 +172,7 @@ def get_patches_cves(d):
>>      import re
>>
>>      pn = d.getVar("PN")
>> +
>>      cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+")
>>
>>      # Matches last CVE-1234-211432 in the file name, also if written
>> -- 
>> 2.25.1
>>
>> 
>>