[OE-core][PATCH v9 0/3] CVE-check handling

Andrej Valek
2023-06-23T11:16:24Z

After discussion in all parallel threads we proposed following variant which
covers both expressed requirements to have very small number of different cve
statuses and also very large number of them at the same time.
This is a compromise version which maybe is not ideal but deals with
conflicting responses we got.

Changes compared to version 8:
- moved CVE_CHECK_STATUSMAP into separated cve-check-map.conf file
- this will allow to use it without inheriting the cve-check class, like for SPDX

Documentation will be updated in separated repository.

meta/classes/cve-check.bbclass | 81 +++-
meta/conf/bitbake.conf | 1 +
meta/conf/cve-check-map.conf | 28 ++
.../distro/include/cve-extra-exclusions.inc | 371 +++++++++---------
meta/lib/oe/cve_check.py | 25 ++
meta/lib/oeqa/selftest/cases/cve_check.py | 26 +-
meta/recipes-bsp/grub/grub2.inc | 6 +-
meta/recipes-connectivity/avahi/avahi_0.8.bb | 3 +-
.../recipes-connectivity/bind/bind_9.18.15.bb | 2 +-
.../bluez5/bluez5_5.66.bb | 4 +-
.../openssh/openssh_9.3p1.bb | 9 +-
.../openssl/openssl_3.1.1.bb | 3 +-
meta/recipes-core/coreutils/coreutils_9.3.bb | 4 +-
meta/recipes-core/glibc/glibc_2.37.bb | 17 +-
meta/recipes-core/libxml/libxml2_2.10.4.bb | 4 -
meta/recipes-core/systemd/systemd_253.3.bb | 3 -
meta/recipes-devtools/cmake/cmake.inc | 4 +-
meta/recipes-devtools/flex/flex_2.6.4.bb | 6 +-
meta/recipes-devtools/gcc/gcc-13.1.inc | 3 +-
meta/recipes-devtools/git/git_2.39.3.bb | 7 -
meta/recipes-devtools/jquery/jquery_3.6.3.bb | 5 +-
meta/recipes-devtools/ninja/ninja_1.11.1.bb | 3 +-
.../recipes-devtools/python/python3_3.11.3.bb | 13 +-
meta/recipes-devtools/qemu/qemu.inc | 13 +-
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 3 -
meta/recipes-devtools/tcltk/tcl_8.6.13.bb | 4 -
meta/recipes-extended/cpio/cpio_2.14.bb | 3 +-
meta/recipes-extended/cups/cups.inc | 17 +-
.../ghostscript/ghostscript_10.01.1.bb | 3 +-
.../iputils/iputils_20221126.bb | 5 +-
.../libtirpc/libtirpc_1.3.3.bb | 3 +-
.../logrotate/logrotate_3.21.0.bb | 5 +-
meta/recipes-extended/procps/procps_4.0.3.bb | 4 -
meta/recipes-extended/shadow/shadow_4.13.bb | 7 +-
meta/recipes-extended/unzip/unzip_6.0.bb | 3 +-
.../xinetd/xinetd_2.3.15.4.bb | 2 +-
meta/recipes-extended/zip/zip_3.0.bb | 7 +-
.../libnotify/libnotify_0.8.2.bb | 2 +-
meta/recipes-gnome/librsvg/librsvg_2.56.0.bb | 3 +-
meta/recipes-graphics/builder/builder_0.1.bb | 3 +-
.../xorg-xserver/xserver-xorg.inc | 19 +-
.../linux/cve-exclusion_6.1.inc | 11 +-
.../libpng/libpng_1.6.39.bb | 3 +-
meta/recipes-multimedia/libtiff/tiff_4.5.0.bb | 10 +-
.../libgcrypt/libgcrypt_1.10.2.bb | 4 +-
.../recipes-support/libxslt/libxslt_1.1.38.bb | 4 +-
meta/recipes-support/lz4/lz4_1.9.4.bb | 3 +-
meta/recipes-support/sqlite/sqlite3_3.41.2.bb | 7 -
48 files changed, 403 insertions(+), 373 deletions(-)
create mode 100644 meta/conf/cve-check-map.conf

--
2.41.0