Re: [OE-core][PATCH v3 1/5] cve-check: annotate CVEs during analysis

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Fri, 2024-07-26 at 15:02 +0200, Marta Rybczynska wrote:
> On Thu, Jul 25, 2024 at 5:27 PM Richard Purdie <richard.purdie@linuxfoundation.org> wrote:
> > On Thu, 2024-07-25 at 16:48 +0200, mrybczynska@syslinbit.com wrote:
> > > On 25.07.2024 16:29, Richard Purdie wrote:
> > > > Hi Marta,
> > > > 
> > > > 
> > > > With the v3 series applied we did just see this on the autobuilder
> > > > unfortunately so I'm not sure that problem is addressed:
> > > > 
> > > > https://autobuilder.yoctoproject.org/typhoon/#/builders/87/builds/7004/steps/14/logs/stdio
> > > > 
> > > 
> > > Hello Richard,
> > > Thanks, this is unfortunate. Is it possible to have a copy of the
> > > corrupted database somewhere?
> > 
> > I think it is transient as we never clean it up and not all tasks fail.
> > That seems to imply it is a race of some kind.
> 
> I have a few ideas of what it might be, but I do not have a reproducer right now. With the
> vex changes, the duration of the cve_check operation changed slightly. On the other hand,
> the database download is slower these days (I have had standalone runs that lasted for 5+ hours).
> Also, I noticed that there were cancellations of some of the build, so the cancellation of the download
> may be in play too.
> 
> A question: autobuilder configuration does share DL_DIR among multiple builds?

DL_DIR is shared between all the workers over NFS.

> My possibility list right now:
> - the "download" job timeout too short
> - download failure/timeout
> - job cancellation during the download

While a download is in progress, the exclusive lock should be held. If
the database were damaged, I'd then expect all subsequent cve_check
tasks to fail the same way.

In the failures, 2 or 3 tasks fail, the rest all continue to work. So
ti doesn't really fit.

> What do you think?

I'm wondering if we should make the do_fetch of the database recipe
copy the database to somewhere in TMPDIR when it finishes, then have
the main cve_check class use the copy there. This would move NFS issues
out the equation?

That would be more in keeping with how other recipes work, just using
DL_DIR as an accelerator. 

Cheers,

Richard