Re: [OE-core] [PATCH scarthgap 0/3] meta: Backport rejected CVEs and SPDX3 fixes

[Benjamin Robin <benjamin.robin@bootlin.com>]

On Wednesday, March 4, 2026 at 8:14 PM, Yoann Congal wrote:
> On Tue Mar 3, 2026 at 5:46 PM CET, Benjamin Robin via lists.openembedded.org wrote:
> > This series backports three patches from `master` to `Scarthgap`.
> >
> > Removed references to rejected CVEs:
> >  - Removed references to `CVE-2025-62813` and `CVE-2021-3502` in patch
> >    files, as these CVEs have been rejected.
> >  - This change prevents rejected CVE references from appearing in the
> >    generated SBOM.
> >
> > Fixed kernel `CONFIG_` generation in SPDX3:
> >  - Backported a fix for the generation of kernel `CONFIG_` values in
> >    SPDX3 output.
> >  - This is a important fix, as the generated SBOM file might otherwise
> >    randomly omit kernel `CONFIG_` values.
> 
> Hello,
> 
> Can you please send the equivalent series for whinlatter?

Hello Yoann,

I can send an "equivalent" series for whinlatter but only with the CVE
"fixes".
The generation of kernel `CONFIG_` values in SPDX3 output was not
backported in whinlatter: It is only in master and Scarthgap.

Let me know what I need to do in this case?

Best regards,
-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com