Re: [OE-core] [PATCH v6 2/4] cvelistv5: add a new recipe

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Thu, 2026-01-29 at 16:10 -0500, vboudevin via lists.openembedded.org wrote:
> This recipe is in charge of cloning and setting the cvelistv5
> repository: https://github.com/CVEProject/cvelistV5
> 
> The variable CVELISTV5_USE_AUTOREV can be used to use AUTOREV to use the
> latest available commit on the remote repository and stay
> up-to-date with the latest CVE information available.
> 
> AUTOREV would make the build non-deterministic, turned off by default.
> 
> Signed-off-by: ValentinBoudevin <valentin.boudevin@gmail.com>
> ---
>  .../cvelistv5-native/cvelistv5-native_git.bb  | 24 +++++++++++++++++++
>  1 file changed, 24 insertions(+)
>  create mode 100644 meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
> 
> diff --git a/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb b/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
> new file mode 100644
> index 0000000000..f25dda9f3d
> --- /dev/null
> +++ b/meta/recipes-kernel/cvelistv5-native/cvelistv5-native_git.bb
> @@ -0,0 +1,24 @@
> +SUMMARY = "CVE List V5"
> +DESCRIPTION = "Official CVE List. It is a catalog of all CVE Records identified by, or reported to, the CVE Program. \
> +The cvelistV5 repository hosts downloadable files of CVE Records in the CVE Record Format."
> +HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
> +LICENSE = "cve-tou"
> +LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/cve-tou;md5=4f7e96b3094e80e66b53359a8342c7f8"
> +
> +inherit native allarch
> +
> +SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https"
> +CVELISTV5_USE_AUTOREV ?= "0"
> +CVELISTV5_DEFAULT_SRCREV ?= "644ce1758db1773336ebebb6a0da90e132da0eb7"
> +
> +python __anonymous () {
> +    if d.getVar("CVELISTV5_USE_AUTOREV") == "1":
> +        d.setVar("SRCREV", d.getVar("AUTOREV"))
> +    else:
> +        d.setVar("SRCREV", d.getVar("CVELISTV5_DEFAULT_SRCREV"))
> +}
> +
> +do_install(){
> +	install -d ${D}${datadir}/cvelistv5-native
> +	cp -r ${UNPACKDIR}/cvelistv5-git/* ${D}${datadir}/cvelistv5-native/
> +}

Why add a CVELISTV5_DEFAULT_SRCREV variable when this is a standard usage of autorev?

SRCREV = "644ce1758db1773336ebebb6a0da90e132da0eb7"

and then users can set:

SRCREV:pn-cvelistv5-native = "${AUTROREV}"

if they want it, just the same as any other recipe?

Cheers,

Richard