public inbox for openembedded-core@lists.openembedded.org
 help / color / mirror / Atom feed
* [PATCH v3 0/6] sbom-cve-check: add CVE analysis tool and class
@ 2026-02-26 17:01 Benjamin Robin
  2026-02-26 17:01 ` [PATCH v3 1/6] maintainers.inc: Sort list in alphabetical order Benjamin Robin
                   ` (5 more replies)
  0 siblings, 6 replies; 10+ messages in thread
From: Benjamin Robin @ 2026-02-26 17:01 UTC (permalink / raw)
  To: openembedded-core
  Cc: ross.burton, peter.marko, jpewhacker, olivier.benjamin,
	antonin.godard, mathieu.dubois-briand, thomas.petazzoni,
	Benjamin Robin

This patch series introduces the `sbom-cve-check` tool and its
dependencies. The tool requires `python3-spdx-python-model`, which has
the following build-time dependencies (not required at runtime):
- `python3-hatch-build-scripts`
- `python3-shacl2code`

Additionally, this series includes a post-build CVE analysis class,
similar to the existing `cve-check` functionality.

`sbom-cve-check` is a lightweight SBOM CVE analysis tool, which
supports SBOMs in SPDX 2.2 or SPDX 3.0 formats. The tool is designed as
an efficient replacement for the `cve-check` logic currently available
in Yocto Project. It fetches data from multiple databases, including NVD
and the CVE List, and supports various annotation formats, such as
OpenVEX and the Yocto Project's custom VEX manifest.

For export, `sbom-cve-check` can generate a SPDX 3.0 file, a
`cve-check`-compatible JSON file, and a summary report that lists all
vulnerabilities per component, styled similarly to the output of the
Yocto Project's `cve-check` class.

For more context on the inclusion of `sbom-cve-check` in OpenEmbedded
Core, see the discussion [1].

For detailed documentation about `sbom-cve-check`, visit [2].

After the inclusion of SPDX3 Joshua changes ("Add SPDX 3 Recipe
Information") in OE-Core [3], and after the release of sbom-cve-check
1.2.0, I am going to submit a very small follow-up series.

[1] https://lists.openembedded.org/g/openembedded-core/topic/117638558
[2] https://sbom-cve-check.readthedocs.io/
[3] https://lists.openembedded.org/g/openembedded-core/message/231519

Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
---
Changes in v3:
- Improve first commit message about sorting maintainers.inc.
- Add missing maintainers information for sbom-cve-check-update-*-native
  recipes...
- Link to v2: https://lore.kernel.org/r/20260225-add-sbom-cve-check-v2-0-eeffa285b901@bootlin.com

Changes in v2:
- Sort maintainers.inc list in alphabetical order.
- Add missing maintainers information for new recipes.
- python3-spdx-python-model depends on native shacl2code and
  hatch-build-scripts recipes.
- Link to v1: https://lore.kernel.org/r/20260224-add-sbom-cve-check-v1-0-1c76fbd7f01b@bootlin.com

---
Benjamin Robin (6):
      maintainers.inc: Sort list in alphabetical order
      python3-shacl2code: add recipe
      python3-hatch-build-scripts: add recipe
      python3-spdx-python-model: add recipe
      sbom-cve-check: add recipe
      sbom-cve-check.bbclass: Add class for post-build CVE analysis

 .../sbom-cve-check-update-db.bbclass               | 87 ++++++++++++++++++++
 meta/classes-recipe/sbom-cve-check.bbclass         | 96 ++++++++++++++++++++++
 meta/conf/distro/include/maintainers.inc           | 74 +++++++++--------
 .../meta/sbom-cve-check-update-cvelist-native.bb   |  7 ++
 .../meta/sbom-cve-check-update-nvd-native.bb       |  7 ++
 .../python/python3-hatch-build-scripts_1.0.0.bb    | 12 +++
 .../python/python3-sbom-cve-check_1.1.0.bb         | 17 ++++
 .../python/python3-shacl2code_0.0.24.bb            | 17 ++++
 ...enerate-bindings-allow-to-use-local-files.patch | 58 +++++++++++++
 .../python/python3-spdx-python-model_0.0.4.bb      | 37 +++++++++
 10 files changed, 378 insertions(+), 34 deletions(-)
---
base-commit: c0c2339a52c689be13c96b66c54b11aed227ca04
change-id: 20260223-add-sbom-cve-check-f34614b147dc

Best regards,
-- 
Benjamin Robin <benjamin.robin@bootlin.com>



^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-03-09 12:17 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-26 17:01 [PATCH v3 0/6] sbom-cve-check: add CVE analysis tool and class Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 1/6] maintainers.inc: Sort list in alphabetical order Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 2/6] python3-shacl2code: add recipe Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 3/6] python3-hatch-build-scripts: " Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 4/6] python3-spdx-python-model: " Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 5/6] sbom-cve-check: " Benjamin Robin
2026-02-26 17:01 ` [PATCH v3 6/6] sbom-cve-check.bbclass: Add class for post-build CVE analysis Benjamin Robin
2026-03-05 13:47   ` [OE-core] " Paul Barker
2026-03-05 16:22     ` Benjamin Robin
2026-03-09 12:17       ` Benjamin Robin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox