Re: [OE-core][PATCH v9 0/3] CVE-check handling

["Valek, Andrej" <andrej.valek@siemens.com>]

Hello,

I would like to ask, what's the status here?

Regards,
Andrej

On Fri, 2023-06-23 at 13:14 +0200, Andrej Valek wrote:
> After discussion in all parallel threads we proposed following variant which
> covers both expressed requirements to have very small number of different cve
> statuses and also very large number of them at the same time.
> This is a compromise version which maybe is not ideal but deals with
> conflicting responses we got.
> 
> Changes compared to version 8:
>  - moved CVE_CHECK_STATUSMAP into separated cve-check-map.conf file
>   - this will allow to use it without inheriting the cve-check class, like for
> SPDX
> 
> Documentation will be updated in separated repository.
> 
>  meta/classes/cve-check.bbclass                |  81 +++-
>  meta/conf/bitbake.conf                        |   1 +
>  meta/conf/cve-check-map.conf                  |  28 ++
>  .../distro/include/cve-extra-exclusions.inc   | 371 +++++++++---------
>  meta/lib/oe/cve_check.py                      |  25 ++
>  meta/lib/oeqa/selftest/cases/cve_check.py     |  26 +-
>  meta/recipes-bsp/grub/grub2.inc               |   6 +-
>  meta/recipes-connectivity/avahi/avahi_0.8.bb  |   3 +-
>  .../recipes-connectivity/bind/bind_9.18.15.bb |   2 +-
>  .../bluez5/bluez5_5.66.bb                     |   4 +-
>  .../openssh/openssh_9.3p1.bb                  |   9 +-
>  .../openssl/openssl_3.1.1.bb                  |   3 +-
>  meta/recipes-core/coreutils/coreutils_9.3.bb  |   4 +-
>  meta/recipes-core/glibc/glibc_2.37.bb         |  17 +-
>  meta/recipes-core/libxml/libxml2_2.10.4.bb    |   4 -
>  meta/recipes-core/systemd/systemd_253.3.bb    |   3 -
>  meta/recipes-devtools/cmake/cmake.inc         |   4 +-
>  meta/recipes-devtools/flex/flex_2.6.4.bb      |   6 +-
>  meta/recipes-devtools/gcc/gcc-13.1.inc        |   3 +-
>  meta/recipes-devtools/git/git_2.39.3.bb       |   7 -
>  meta/recipes-devtools/jquery/jquery_3.6.3.bb  |   5 +-
>  meta/recipes-devtools/ninja/ninja_1.11.1.bb   |   3 +-
>  .../recipes-devtools/python/python3_3.11.3.bb |  13 +-
>  meta/recipes-devtools/qemu/qemu.inc           |  13 +-
>  meta/recipes-devtools/rsync/rsync_3.2.7.bb    |   3 -
>  meta/recipes-devtools/tcltk/tcl_8.6.13.bb     |   4 -
>  meta/recipes-extended/cpio/cpio_2.14.bb       |   3 +-
>  meta/recipes-extended/cups/cups.inc           |  17 +-
>  .../ghostscript/ghostscript_10.01.1.bb        |   3 +-
>  .../iputils/iputils_20221126.bb               |   5 +-
>  .../libtirpc/libtirpc_1.3.3.bb                |   3 +-
>  .../logrotate/logrotate_3.21.0.bb             |   5 +-
>  meta/recipes-extended/procps/procps_4.0.3.bb  |   4 -
>  meta/recipes-extended/shadow/shadow_4.13.bb   |   7 +-
>  meta/recipes-extended/unzip/unzip_6.0.bb      |   3 +-
>  .../xinetd/xinetd_2.3.15.4.bb                 |   2 +-
>  meta/recipes-extended/zip/zip_3.0.bb          |   7 +-
>  .../libnotify/libnotify_0.8.2.bb              |   2 +-
>  meta/recipes-gnome/librsvg/librsvg_2.56.0.bb  |   3 +-
>  meta/recipes-graphics/builder/builder_0.1.bb  |   3 +-
>  .../xorg-xserver/xserver-xorg.inc             |  19 +-
>  .../linux/cve-exclusion_6.1.inc               |  11 +-
>  .../libpng/libpng_1.6.39.bb                   |   3 +-
>  meta/recipes-multimedia/libtiff/tiff_4.5.0.bb |  10 +-
>  .../libgcrypt/libgcrypt_1.10.2.bb             |   4 +-
>  .../recipes-support/libxslt/libxslt_1.1.38.bb |   4 +-
>  meta/recipes-support/lz4/lz4_1.9.4.bb         |   3 +-
>  meta/recipes-support/sqlite/sqlite3_3.41.2.bb |   7 -
>  48 files changed, 403 insertions(+), 373 deletions(-)
>  create mode 100644 meta/conf/cve-check-map.conf
>