Re: [PATCH v6] sbom-cve-check: Add class for post-build CVE analysis

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Marta,

On Friday, March 20, 2026 at 4:54 PM, Marta Rybczynska wrote:
> > ---
> >  meta/classes-recipe/sbom-cve-check.bbclass         | 121
> > +++++++++++++++++++++
> >  meta/conf/distro/include/maintainers.inc           |   2 +
> >  meta/conf/fragments/yocto/sbom-cve-check.conf      |  14 +++
> >  meta/recipes-core/meta/sbom-cve-check-config.inc   |   4 +
> >  .../meta/sbom-cve-check-update-cvelist-native.bb   |  12 ++
> >  .../recipes-core/meta/sbom-cve-check-update-db.inc |  28 +++++
> >  .../meta/sbom-cve-check-update-nvd-native.bb       |  12 ++
> >  7 files changed, 193 insertions(+)
> >
> >
> Hello,
> That looks cleaner than the previous version. How long does the intiial
> build take with
> this fetcher?
> 
> Kind regards,
> Marta

I am not sure to understand the question.

With this fetcher, the duration of the initial clone is a "bit" slower,
since we are not doing a shallow clone. If the download directory is
not deleted, the initial fetch is done only once.

The fetch can be realized in parallel with the build of the packages,
and it really depends of your internet connection and of the build
machine.

But if I run:

$ bitbake -c cleanall sbom-cve-check-update-cvelist-native \
   sbom-cve-check-update-nvd-native

Followed by:

$ time bitbake sbom-cve-check-update-cvelist-native \
   sbom-cve-check-update-nvd-native

The time elapsed is 5m10.211s
I hope this answer your question.

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com