[PATCH v7 0/4] generate-cve-exclusions: Add a .bbclass

[PATCH v7 0/4] generate-cve-exclusions: Add a .bbclass

[ValentinBoudevin]

From: ValentinBoudevinSFL <valentin.boudevin@savoirfairelinux.com>

Changes since v6:
- Update the maintainers.inc file to add new maintainer for the
  cvelistv5-native recipe.
- Update cvelistv5-native recipe to remove the variables CVELISTV5_DEFAULT_SRCREV and CVELISTV5_USE_AUTOREV for a fixed
  SRCREV usage (AUTOREV will be recommended in the documentation if the user wants to use the latest available commit).

Changes since v5:
- Add a new commit to add a new recipe cvelistv5-native to clone the
  cvelistv5 repository.
- Update the script generate-cve-exclusions.py to use provide the JSON
  format output with the INC output at the same time using --output-json-file and
  --output-inc-file options.
- Update the .bbclass to use the new cvelistv5-native recipe.
- Remove tasks and variables from the .bbclass to simplify the code:
  * Remove the do_clone_cvelistV5 task.
  * Remove __anonymous function to setup SRC_URI and SRCREV.
  * Remove the variables GENERATE_CVE_EXCLUSIONS_SRC_URI,
    GENERATE_CVE_EXCLUSIONS_SRCREV, GENERATE_CVE_EXCLUSIONS_NETWORK, GENERATE_CVE_EXCLUSIONS_WORKDIR,
    GENERATE_CVE_EXCLUSIONS_DESTSUFFIX, and GENERATE_CVE_EXCLUSIONS_UNPACK_DIR
    since they are not needed anymore.
- Remove direct inclusion in linux-yocto.inc and let the user include the
  bbclass in their kernel recipe if they want to use it.
  Using ENABLE_KERNEL_CVE_EXCLUSIONS variable to enable/disable the feature is
  not needed anymore. Including the bbclass is a cleaner implementation compare to set a variable
  to enable/disable the feature.
- Add the variables:
  *GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON
  *GENERATE_CVE_EXCLUSIONS_OUTPUT_INC
  to customize the output paths of the generated files.

Changes since v4:
- Patch 2/4:
  * Renamed the bbclass to kernel-generate-cve-exclusions.bbclass to better reflect its purpose.
  * Add new variable ENABLE_KERNEL_CVE_EXCLUSIONS to enable/disable the
  feature.
  By default, the feature is disabled to avoid unexpected behavior on
  existing builds with linux-yocto.
  * Add new "__anonymous" python function to setup the variables SRC_URI and SRCREV only if
  this feature is enabled with ENABLE_KERNEL_CVE_EXCLUSIONS.
  Also prevent from modifying SRC_URI and SRCREV variables in the default linux-yocto usecase.
  Now, the recipe does not have any impact on the basic "linux-yocto" recipe if the feature is disabled.
  * Add new variables GENERATE_CVE_EXCLUSIONS_DESTSUFFIX and
  GENERATE_CVE_EXCLUSIONS_UNPACK_DIR to customize the working directory path of the
  class.
- Patch 4/4:
  * Update the inherit statement in linux-yocto.inc to reflect the new name of the bbclass with
  "kernel-generate-cve-exclusions".

Changes since v3:
- Patch 2/4:
  * Add variables to control offline mode, source URI and
  SRCREV for deterministic testing (GENERATE_CVE_EXCLUSIONS_SRC_URI,
  GENERATE_CVE_EXCLUSIONS_SRCREV, GENERATE_CVE_EXCLUSIONS_NETWORK).
  * Updated generate_cve_exclusions task scheduling to be executed before
  do_cve_check.

Changes since v2:
- Patch 4/4: Inherit the new bbclass in linux-yocto.inc instead of
  individual recipes.

Changes since v1:
- Patch 2/4: Removed the mandatory execution of the
  generate-cve-exclusions class on every build. It now needs to be
  manually run using:
    bitbake -c generate-cve-exclusions <kernel-recipe>

ValentinBoudevin (4):
  generate-cve-exclusions: Add output format option
  cvelistv5: add a new recipe
  kernel-generate-cve-exclusions: Add a .bbclass
  generate-cve-exclusions: Move python script

 .../kernel-generate-cve-exclusions.bbclass    |  46 ++++++++
 meta/conf/distro/include/maintainers.inc      |   1 +
 .../cvelistv5-native/cvelistv5-native_git.bb  |  19 ++++
 .../contrib}/generate-cve-exclusions.py       | 107 +++++++++++++++---
 4 files changed, 156 insertions(+), 17 deletions(-)
 create mode 100644 meta/classes/kernel-generate-cve-exclusions.bbclass
 create mode 100644 meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
 rename {meta/recipes-kernel/linux => scripts/contrib}/generate-cve-exclusions.py (55%)

[PATCH v7 1/4] generate-cve-exclusions: Add output format option

[ValentinBoudevin]

This option "--output-json-file" can be used to return a json file instead of
the printing the output in a .inc file.
The JSON file can easily be manipulated contrary to the .inc file.

Example output structure of the JSON file:

```json
{
  "cve_status": {
    "CVE-2019-25160": {
      "active": false,
      "message": "fixed-version: Fixed from version 5.0"
    },
    "CVE-2019-25162": {
      "active": false,
      "message": "fixed-version: Fixed from version 6.0"
    },
...
```

Add a second option "--output-inc-file" to also create a .inc at a given
location.

Both "--output-inc-file" and "--output-json-file" can be used at the
same time.

This commit doesn't affect or modify any existing behaviour of the
script.

Signed-off-by: Valentin Boudevin <valentin.boudevin@gmail.com>
---
 .../linux/generate-cve-exclusions.py          | 107 +++++++++++++++---
 1 file changed, 90 insertions(+), 17 deletions(-)

diff --git a/meta/recipes-kernel/linux/generate-cve-exclusions.py b/meta/recipes-kernel/linux/generate-cve-exclusions.py
index dfc16663a5..3df0e93e07 100755
--- a/meta/recipes-kernel/linux/generate-cve-exclusions.py
+++ b/meta/recipes-kernel/linux/generate-cve-exclusions.py
@@ -91,19 +91,38 @@ def main(argp=None):
     parser = argparse.ArgumentParser()
     parser.add_argument("datadir", type=pathlib.Path, help="Path to a clone of https://github.com/CVEProject/cvelistV5 or https://git.kernel.org/pub/scm/linux/security/vulns.git")
     parser.add_argument("version", type=Version, help="Kernel version number to generate data for, such as 6.1.38")
+    parser.add_argument("--output-json-file", type=pathlib.Path, help="Write CVE_STATUS mapping to this JSON file")
+    parser.add_argument("--output-inc-file", type=pathlib.Path, help="Write CVE_STATUS mapping to this INC file")
 
     args = parser.parse_args(argp)
     datadir = args.datadir.resolve()
     version = args.version
     base_version = Version(f"{version.major}.{version.minor}")
-
-    data_version = subprocess.check_output(("git", "describe", "--tags", "HEAD"), cwd=datadir, text=True)
-
-    print(f"""
+    print_to_stdout = not args.output_json_file and not args.output_inc_file
+
+    cve_status = {}
+    inc_lines = []
+    
+    if print_to_stdout:
+        data_version = subprocess.check_output(("git", "describe", "--tags", "HEAD"), cwd=datadir, text=True)
+        print(f"""
 # Auto-generated CVE metadata, DO NOT EDIT BY HAND.
 # Generated at {datetime.datetime.now(datetime.timezone.utc)} for kernel version {version}
 # From {datadir.name} {data_version}
 
+python check_kernel_cve_status_version() {{
+    this_version = "{version}"
+    kernel_version = d.getVar("LINUX_VERSION")
+    if kernel_version != this_version:
+        bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version))
+}}
+do_cve_check[prefuncs] += "check_kernel_cve_status_version"
+""")
+    elif args.output_inc_file:
+        inc_lines.append(f"""
+# Auto-generated CVE metadata, DO NOT EDIT BY HAND.
+# Generated at {datetime.datetime.now(datetime.timezone.utc)} for kernel version {version}
+
 python check_kernel_cve_status_version() {{
     this_version = "{version}"
     kernel_version = d.getVar("LINUX_VERSION")
@@ -131,26 +150,80 @@ do_cve_check[prefuncs] += "check_kernel_cve_status_version"
             continue
         first_affected, fixed, backport_ver = get_fixed_versions(cve_info, base_version)
         if not fixed:
-            print(f"# {cve} has no known resolution")
+            cve_status[cve] = {
+                "active": True,
+                "message": "no known resolution"
+            }
+            if not args.output_json_file:
+                print(f"# {cve} has no known resolution")
+            elif args.output_inc_file:
+                inc_lines.append(f'# {cve} has no known resolution')
         elif first_affected and version < first_affected:
-            print(f'CVE_STATUS[{cve}] = "fixed-version: only affects {first_affected} onwards"')
+            cve_status[cve] = {
+                "active": False,
+                "message": f"fixed-version: only affects {first_affected} onwards"
+            }
+            if not args.output_json_file:
+                print(f'CVE_STATUS[{cve}] = "fixed-version: only affects {first_affected} onwards"')
+            elif args.output_inc_file:
+                inc_lines.append(f'CVE_STATUS[{cve}] = "fixed-version: only affects {first_affected} onwards"')
         elif fixed <= version:
-            print(
-                f'CVE_STATUS[{cve}] = "fixed-version: Fixed from version {fixed}"'
-            )
+            cve_status[cve] = {
+                "active": False,
+                "message": f"fixed-version: Fixed from version {fixed}"
+            }
+            if not args.output_json_file:
+                print(f'CVE_STATUS[{cve}] = "fixed-version: Fixed from version {fixed}"')
+            elif args.output_inc_file:
+                inc_lines.append(f'CVE_STATUS[{cve}] = "fixed-version: Fixed from version {fixed}"')
         else:
             if backport_ver:
                 if backport_ver <= version:
-                    print(
-                        f'CVE_STATUS[{cve}] = "cpe-stable-backport: Backported in {backport_ver}"'
-                    )
+                    cve_status[cve] = {
+                        "active": False,
+                        "message": f"cpe-stable-backport: Backported in {backport_ver}"
+                    }
+                    if not args.output_json_file:
+                        print(f'CVE_STATUS[{cve}] = "cpe-stable-backport: Backported in {backport_ver}"')
+                    elif args.output_inc_file:
+                        inc_lines.append(f'CVE_STATUS[{cve}] = "cpe-stable-backport: Backported in {backport_ver}"')
                 else:
-                    print(f"# {cve} may need backporting (fixed from {backport_ver})")
+                    cve_status[cve] = {
+                        "active": True,
+                        "message": f"May need backporting (fixed from {backport_ver})"
+                    }
+                    if not args.output_json_file:
+                        print(f"# {cve} may need backporting (fixed from {backport_ver})")
+                    elif args.output_inc_file:
+                        inc_lines.append(f'# {cve} may need backporting (fixed from {backport_ver})')
             else:
-                print(f"# {cve} needs backporting (fixed from {fixed})")
-
-        print()
-
+                cve_status[cve] = {
+                    "active": True,
+                    "message": f"#Needs backporting (fixed from {fixed})"
+                }
+                if not args.output_json_file:
+                    print(f"# {cve} needs backporting (fixed from {fixed})")
+                elif args.output_inc_file:
+                    inc_lines.append(f'# {cve} needs backporting (fixed from {fixed})')
+
+        if print_to_stdout:
+            print()
+        elif args.output_inc_file:
+            inc_lines.append("")
+
+    # Emit structured output if --ret-struct was requested
+    if args.output_json_file:
+        args.output_json_file.write_text(
+        json.dumps(
+                {
+                    "cve_status": cve_status,
+                },
+                indent=2
+            ),
+            encoding="utf-8"
+        )
+    if args.output_inc_file:
+        args.output_inc_file.write_text("\n".join(inc_lines), encoding="utf-8")
 
 if __name__ == "__main__":
     main()

[PATCH v7 2/4] cvelistv5: add a new recipe

[ValentinBoudevin]

This recipe is in charge of cloning and setting the cvelistv5
repository: https://github.com/CVEProject/cvelistV5

If the build is online, it is recommanded to use SRCREV set to AUTOREV
to use the latest available commit on the remote repository and stay
up-to-date with the latest CVE information available.

AUTOREV would make the build non-deterministic which would break
offline, turned off by default.

Signed-off-by: ValentinBoudevin <valentin.boudevin@gmail.com>
---
 meta/conf/distro/include/maintainers.inc      |  1 +
 .../cvelistv5-native/cvelistv5-native_git.bb  | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb

diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc
index e830648945..550ef0e0e7 100644
--- a/meta/conf/distro/include/maintainers.inc
+++ b/meta/conf/distro/include/maintainers.inc
@@ -139,6 +139,7 @@ RECIPE_MAINTAINER:pn-cryptodev-tests = "Robert Yang <liezhi.yang@windriver.com>"
 RECIPE_MAINTAINER:pn-cups = "Chen Qi <Qi.Chen@windriver.com>"
 RECIPE_MAINTAINER:pn-curl = "Robert Joslyn <robert.joslyn@redrectangle.org>"
 RECIPE_MAINTAINER:pn-cve-update-nvd2-native = "Ross Burton <ross.burton@arm.com>"
+RECIPE_MAINTAINER:pn-cvelistv5-native = "Valentin Boudevin <valentin.boudevin@savoirfairelinux.com>"
 RECIPE_MAINTAINER:pn-db = "Unassigned <unassigned@yoctoproject.org>"
 RECIPE_MAINTAINER:pn-dbus = "Chen Qi <Qi.Chen@windriver.com>"
 RECIPE_MAINTAINER:pn-dbus-glib = "Chen Qi <Qi.Chen@windriver.com>"
diff --git a/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb b/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
new file mode 100644
index 0000000000..7ee1f04d0a
--- /dev/null
+++ b/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
@@ -0,0 +1,19 @@
+SUMMARY = "CVE List V5"
+DESCRIPTION = "Official CVE List. It is a catalog of all CVE Records identified by, or reported to, the CVE Program. \
+The cvelistV5 repository hosts downloadable files of CVE Records in the CVE Record Format."
+HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
+LICENSE = "cve-tou"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/cve-tou;md5=4f7e96b3094e80e66b53359a8342c7f8"
+
+inherit allarch native
+
+SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https"
+
+# SRCREV is pinned to a fixed commit to ensure reproducible builds
+# To get the latest commit available and stay up-to-date, set AUTOREV as SRCREV with SRCREV:pn-cvelistv5-native = "${AUTOREV}"
+SRCREV ?= "644ce1758db1773336ebebb6a0da90e132da0eb7"
+
+do_install(){
+	install -d ${D}${datadir}/cvelistv5-native
+	cp -r ${UNPACKDIR}/cvelistv5-git/* ${D}${datadir}/cvelistv5-native/
+}

[PATCH v7 3/4] kernel-generate-cve-exclusions: Add a .bbclass

[ValentinBoudevin]

Add a new class named kernel-generate-cve-exclusions.bbclass to
generate-cve-exclusions to use this script at every run.

Two steps for testing:

1) inherit this class in the kernel recipe with "inherit
   kernel-generate-cve-exclusions.bbclass"
2) Use the following command to generate cve exclusions .json, and .inc
   file : "bitbake linux-yocto -c "do_generate_cve_exclusions"

This class contains several methods:

*do_generate_cve_exclusions: Use the script generate-cve-exclusions.py.
It uses the new "--output-json-file" argument to generate a JSON file as
an output stored in ${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}, and a .inc
file in ${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC}

*do_cve_check:prepend: Parse the previously generated JSON file to set
the variable CVE_STATUS corretly

The class also provides some variables:

*GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON: path of the output JSON file used
to set CVE_STATUS
*GENERATE_CVE_EXCLUSIONS_OUTPUT_INC: cve exclusions .inc file output
path. Not used directly by this class (needs to be inherit manually).

Signed-off-by: Valentin Boudevin <valentin.boudevin@gmail.com>
---
 .../kernel-generate-cve-exclusions.bbclass    | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 meta/classes/kernel-generate-cve-exclusions.bbclass

diff --git a/meta/classes/kernel-generate-cve-exclusions.bbclass b/meta/classes/kernel-generate-cve-exclusions.bbclass
new file mode 100644
index 0000000000..8efa32f6a1
--- /dev/null
+++ b/meta/classes/kernel-generate-cve-exclusions.bbclass
@@ -0,0 +1,46 @@
+# Generate CVE exclusions for the kernel build (set to "1" to enable)
+GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON = "${WORKDIR}/temp/cve-exclusion_${LINUX_VERSION}.json"
+GENERATE_CVE_EXCLUSIONS_OUTPUT_INC  = "${WORKDIR}/temp//cve-exclusion_${LINUX_VERSION}.inc"
+
+do_generate_cve_exclusions() {
+    # Check for required files and directories
+    generate_cve_exclusions_script=${COREBASE}/scripts/contrib/generate-cve-exclusions.py
+    if [ ! -f "${generate_cve_exclusions_script}" ]; then
+        bbwarn "generate-cve-exclusions.py not found in ${generate_cve_exclusions_script}."
+        return 0
+    fi
+    if [ ! -d "${STAGING_DATADIR_NATIVE}/cvelistv5-native" ]; then
+        bbwarn "CVE exclusions source directory not found in ${STAGING_DATADIR_NATIVE}/cvelistv5-native."
+        return 0
+    fi
+    # Generate the CVE exclusions JSON & INC file
+    python3 "${generate_cve_exclusions_script}" \
+        "${STAGING_DATADIR_NATIVE}/cvelistv5-native" \
+        ${LINUX_VERSION} \
+        --output-json-file "${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}" \
+        --output-inc-file "${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC}"
+    bbplain "CVE exclusions generated for kernel version ${LINUX_VERSION} at ${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC} and ${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}."
+}
+do_generate_cve_exclusions[depends] += "cvelistv5-native:do_populate_sysroot"
+do_generate_cve_exclusions[nostamp] = "1"
+do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel build. (e.g., cve-exclusion_6.12.json)"
+addtask generate_cve_exclusions after do_prepare_recipe_sysroot before do_cve_check
+
+python do_cve_check:prepend() {
+    import os
+    import json
+    workdir = d.getVar("${STAGING_DATADIR_NATIVE}/cvelistv5-native")
+    kernel_version = d.getVar("LINUX_VERSION")
+    json_input_file = d.getVar("GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON")
+    if os.path.exists(json_input_file):
+        with open(json_input_file, 'r', encoding='utf-8') as f:
+            cve_data = json.load(f)
+        cve_status_dict = cve_data.get("cve_status", {})
+        count = 0
+        for cve_id, info in cve_status_dict.items():
+            if info.get("active", True):
+                continue
+            d.setVarFlag("CVE_STATUS", cve_id, info.get("message", ""))
+            count += 1
+        bb.note("Loaded %d CVE_STATUS entries from JSON output for kernel %s" % (count, kernel_version))
+}

[PATCH v7 4/4] generate-cve-exclusions: Move python script

[ValentinBoudevin]

The script should be located with other scripts in scripts/contrib
instead of staying in meta/classes/.

Update the new .bbclass to match this modification

Signed-off-by: Valentin Boudevin <valentin.boudevin@gmail.com>
---
 .../linux => scripts/contrib}/generate-cve-exclusions.py          | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename {meta/recipes-kernel/linux => scripts/contrib}/generate-cve-exclusions.py (100%)

diff --git a/meta/recipes-kernel/linux/generate-cve-exclusions.py b/scripts/contrib/generate-cve-exclusions.py
similarity index 100%
rename from meta/recipes-kernel/linux/generate-cve-exclusions.py
rename to scripts/contrib/generate-cve-exclusions.py

RE: [PATCH v7 3/4] kernel-generate-cve-exclusions: Add a .bbclass

[Daniel Turull]

Minor typo

> -----Original Message-----
> From: ValentinBoudevin <valentin.boudevin@gmail.com>
> Sent: Monday, 2 February 2026 21:52
> To: openembedded-core@lists.openembedded.org
> Cc: Daniel Turull <daniel.turull@ericsson.com>;
> jerome.oufella@savoirfairelinux.com; ValentinBoudevin
> <valentin.boudevin@gmail.com>
> Subject: [PATCH v7 3/4] kernel-generate-cve-exclusions: Add a .bbclass
> 
> Add a new class named kernel-generate-cve-exclusions.bbclass to generate-cve-
> exclusions to use this script at every run.
> 
> Two steps for testing:
> 
> 1) inherit this class in the kernel recipe with "inherit
>    kernel-generate-cve-exclusions.bbclass"
> 2) Use the following command to generate cve exclusions .json, and .inc
>    file : "bitbake linux-yocto -c "do_generate_cve_exclusions"
> 
> This class contains several methods:
> 
> *do_generate_cve_exclusions: Use the script generate-cve-exclusions.py.
> It uses the new "--output-json-file" argument to generate a JSON file as an
> output stored in ${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}, and a .inc file
> in ${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC}
> 
> *do_cve_check:prepend: Parse the previously generated JSON file to set the
> variable CVE_STATUS corretly
> 
> The class also provides some variables:
> 
> *GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON: path of the output JSON file
> used to set CVE_STATUS
> *GENERATE_CVE_EXCLUSIONS_OUTPUT_INC: cve exclusions .inc file output
> path. Not used directly by this class (needs to be inherit manually).
> 
> Signed-off-by: Valentin Boudevin <valentin.boudevin@gmail.com>
> ---
>  .../kernel-generate-cve-exclusions.bbclass    | 46 +++++++++++++++++++
>  1 file changed, 46 insertions(+)
>  create mode 100644 meta/classes/kernel-generate-cve-exclusions.bbclass
> 
> diff --git a/meta/classes/kernel-generate-cve-exclusions.bbclass
> b/meta/classes/kernel-generate-cve-exclusions.bbclass
> new file mode 100644
> index 0000000000..8efa32f6a1
> --- /dev/null
> +++ b/meta/classes/kernel-generate-cve-exclusions.bbclass
> @@ -0,0 +1,46 @@
> +# Generate CVE exclusions for the kernel build (set to "1" to enable)
> +GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON = "${WORKDIR}/temp/cve-
> exclusion_${LINUX_VERSION}.json"
> +GENERATE_CVE_EXCLUSIONS_OUTPUT_INC  = "${WORKDIR}/temp//cve-
> exclusion_${LINUX_VERSION}.inc"
Remove one / after temp

> +
> +do_generate_cve_exclusions() {
> +    # Check for required files and directories
> +    generate_cve_exclusions_script=${COREBASE}/scripts/contrib/generate-cve-
> exclusions.py
> +    if [ ! -f "${generate_cve_exclusions_script}" ]; then
> +        bbwarn "generate-cve-exclusions.py not found in
> ${generate_cve_exclusions_script}."
> +        return 0
> +    fi
> +    if [ ! -d "${STAGING_DATADIR_NATIVE}/cvelistv5-native" ]; then
> +        bbwarn "CVE exclusions source directory not found in
> ${STAGING_DATADIR_NATIVE}/cvelistv5-native."
> +        return 0
> +    fi
> +    # Generate the CVE exclusions JSON & INC file
> +    python3 "${generate_cve_exclusions_script}" \
> +        "${STAGING_DATADIR_NATIVE}/cvelistv5-native" \
> +        ${LINUX_VERSION} \
> +        --output-json-file "${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}" \
> +        --output-inc-file "${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC}"
> +    bbplain "CVE exclusions generated for kernel version ${LINUX_VERSION} at
> ${GENERATE_CVE_EXCLUSIONS_OUTPUT_INC} and
> ${GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON}."
> +}
> +do_generate_cve_exclusions[depends] += "cvelistv5-
> native:do_populate_sysroot"
> +do_generate_cve_exclusions[nostamp] = "1"
> +do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel
> build. (e.g., cve-exclusion_6.12.json)"
> +addtask generate_cve_exclusions after do_prepare_recipe_sysroot before
> +do_cve_check
> +
> +python do_cve_check:prepend() {
> +    import os
> +    import json
> +    workdir = d.getVar("${STAGING_DATADIR_NATIVE}/cvelistv5-native")
> +    kernel_version = d.getVar("LINUX_VERSION")
> +    json_input_file = d.getVar("GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON")
> +    if os.path.exists(json_input_file):
> +        with open(json_input_file, 'r', encoding='utf-8') as f:
> +            cve_data = json.load(f)
> +        cve_status_dict = cve_data.get("cve_status", {})
> +        count = 0
> +        for cve_id, info in cve_status_dict.items():
> +            if info.get("active", True):
> +                continue
> +            d.setVarFlag("CVE_STATUS", cve_id, info.get("message", ""))
> +            count += 1
> +        bb.note("Loaded %d CVE_STATUS entries from JSON output for
> +kernel %s" % (count, kernel_version)) }

Daniel

RE: [PATCH v7 0/4] generate-cve-exclusions: Add a .bbclass

[Daniel Turull]

This series looks good to me. I have tested it offline. Only a small typo in patch 3.

Daniel

> -----Original Message-----
> From: ValentinBoudevin <valentin.boudevin@gmail.com>
> Sent: Monday, 2 February 2026 21:52
> To: openembedded-core@lists.openembedded.org
> Cc: Daniel Turull <daniel.turull@ericsson.com>;
> jerome.oufella@savoirfairelinux.com; ValentinBoudevinSFL
> <valentin.boudevin@savoirfairelinux.com>
> Subject: [PATCH v7 0/4] generate-cve-exclusions: Add a .bbclass
> 
> From: ValentinBoudevinSFL <valentin.boudevin@savoirfairelinux.com>
> 
> Changes since v6:
> - Update the maintainers.inc file to add new maintainer for the
>   cvelistv5-native recipe.
> - Update cvelistv5-native recipe to remove the variables
> CVELISTV5_DEFAULT_SRCREV and CVELISTV5_USE_AUTOREV for a fixed
>   SRCREV usage (AUTOREV will be recommended in the documentation if the user
> wants to use the latest available commit).
> 
> Changes since v5:
> - Add a new commit to add a new recipe cvelistv5-native to clone the
>   cvelistv5 repository.
> - Update the script generate-cve-exclusions.py to use provide the JSON
>   format output with the INC output at the same time using --output-json-file and
>   --output-inc-file options.
> - Update the .bbclass to use the new cvelistv5-native recipe.
> - Remove tasks and variables from the .bbclass to simplify the code:
>   * Remove the do_clone_cvelistV5 task.
>   * Remove __anonymous function to setup SRC_URI and SRCREV.
>   * Remove the variables GENERATE_CVE_EXCLUSIONS_SRC_URI,
>     GENERATE_CVE_EXCLUSIONS_SRCREV,
> GENERATE_CVE_EXCLUSIONS_NETWORK,
> GENERATE_CVE_EXCLUSIONS_WORKDIR,
>     GENERATE_CVE_EXCLUSIONS_DESTSUFFIX, and
> GENERATE_CVE_EXCLUSIONS_UNPACK_DIR
>     since they are not needed anymore.
> - Remove direct inclusion in linux-yocto.inc and let the user include the
>   bbclass in their kernel recipe if they want to use it.
>   Using ENABLE_KERNEL_CVE_EXCLUSIONS variable to enable/disable the
> feature is
>   not needed anymore. Including the bbclass is a cleaner implementation compare
> to set a variable
>   to enable/disable the feature.
> - Add the variables:
>   *GENERATE_CVE_EXCLUSIONS_OUTPUT_JSON
>   *GENERATE_CVE_EXCLUSIONS_OUTPUT_INC
>   to customize the output paths of the generated files.
> 
> Changes since v4:
> - Patch 2/4:
>   * Renamed the bbclass to kernel-generate-cve-exclusions.bbclass to better
> reflect its purpose.
>   * Add new variable ENABLE_KERNEL_CVE_EXCLUSIONS to enable/disable the
>   feature.
>   By default, the feature is disabled to avoid unexpected behavior on
>   existing builds with linux-yocto.
>   * Add new "__anonymous" python function to setup the variables SRC_URI and
> SRCREV only if
>   this feature is enabled with ENABLE_KERNEL_CVE_EXCLUSIONS.
>   Also prevent from modifying SRC_URI and SRCREV variables in the default linux-
> yocto usecase.
>   Now, the recipe does not have any impact on the basic "linux-yocto" recipe if the
> feature is disabled.
>   * Add new variables GENERATE_CVE_EXCLUSIONS_DESTSUFFIX and
>   GENERATE_CVE_EXCLUSIONS_UNPACK_DIR to customize the working directory
> path of the
>   class.
> - Patch 4/4:
>   * Update the inherit statement in linux-yocto.inc to reflect the new name of the
> bbclass with
>   "kernel-generate-cve-exclusions".
> 
> Changes since v3:
> - Patch 2/4:
>   * Add variables to control offline mode, source URI and
>   SRCREV for deterministic testing (GENERATE_CVE_EXCLUSIONS_SRC_URI,
>   GENERATE_CVE_EXCLUSIONS_SRCREV,
> GENERATE_CVE_EXCLUSIONS_NETWORK).
>   * Updated generate_cve_exclusions task scheduling to be executed before
>   do_cve_check.
> 
> Changes since v2:
> - Patch 4/4: Inherit the new bbclass in linux-yocto.inc instead of
>   individual recipes.
> 
> Changes since v1:
> - Patch 2/4: Removed the mandatory execution of the
>   generate-cve-exclusions class on every build. It now needs to be
>   manually run using:
>     bitbake -c generate-cve-exclusions <kernel-recipe>
> 
> ValentinBoudevin (4):
>   generate-cve-exclusions: Add output format option
>   cvelistv5: add a new recipe
>   kernel-generate-cve-exclusions: Add a .bbclass
>   generate-cve-exclusions: Move python script
> 
>  .../kernel-generate-cve-exclusions.bbclass    |  46 ++++++++
>  meta/conf/distro/include/maintainers.inc      |   1 +
>  .../cvelistv5-native/cvelistv5-native_git.bb  |  19 ++++
>  .../contrib}/generate-cve-exclusions.py       | 107 +++++++++++++++---
>  4 files changed, 156 insertions(+), 17 deletions(-)  create mode 100644
> meta/classes/kernel-generate-cve-exclusions.bbclass
>  create mode 100644 meta/recipes-kernel/cvelistv5-native/cvelistv5-
> native_git.bb
>  rename {meta/recipes-kernel/linux => scripts/contrib}/generate-cve-
> exclusions.py (55%)