Re: [OE-core] [PATCH scarthgap 0/3] meta: Backport rejected CVEs and SPDX3 fixes

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Mar 3, 2026 at 5:46 PM CET, Benjamin Robin via lists.openembedded.org wrote:
> This series backports three patches from `master` to `Scarthgap`.
>
> Removed references to rejected CVEs:
>  - Removed references to `CVE-2025-62813` and `CVE-2021-3502` in patch
>    files, as these CVEs have been rejected.
>  - This change prevents rejected CVE references from appearing in the
>    generated SBOM.
>
> Fixed kernel `CONFIG_` generation in SPDX3:
>  - Backported a fix for the generation of kernel `CONFIG_` values in
>    SPDX3 output.
>  - This is a important fix, as the generated SBOM file might otherwise
>    randomly omit kernel `CONFIG_` values.
>
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---
> Benjamin Robin (Schneider Electric) (3):
>       avahi: Remove a reference to the rejected CVE-2021-36217
>       lz4: Remove a reference to the rejected CVE-2025-62813
>       meta: fix generation of kernel CONFIG_ in SPDX3
>
>  meta/classes-recipe/kernel.bbclass                 | 27 ++++++++++++----------
>  meta/lib/oeqa/selftest/cases/spdx.py               |  2 +-
>  .../avahi/files/local-ping.patch                   |  1 -
>  ...5-62813.patch => fix-null-error-handling.patch} |  1 -
>  meta/recipes-support/lz4/lz4_1.9.4.bb              |  2 +-
>  5 files changed, 17 insertions(+), 16 deletions(-)
> ---
> base-commit: a9a785d7fa0cfe2a9087dbcde0ef9f0d2a441375
> change-id: 20260303-backport-fixes-scarthgap-c8d4140edfa0
>
> Best regards,

Hello,

Can you please send the equivalent series for whinlatter?

Thanks!
-- 
Yoann Congal
Smile ECS