Re: [OE-core] [PATCH scarthgap 0/3] meta: Backport rejected CVEs and SPDX3 fixes

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Mar 5, 2026 at 9:29 AM CET, Benjamin Robin wrote:
> On Wednesday, March 4, 2026 at 8:14 PM, Yoann Congal wrote:
>> On Tue Mar 3, 2026 at 5:46 PM CET, Benjamin Robin via lists.openembedded.org wrote:
>> > This series backports three patches from `master` to `Scarthgap`.
>> >
>> > Removed references to rejected CVEs:
>> >  - Removed references to `CVE-2025-62813` and `CVE-2021-3502` in patch
>> >    files, as these CVEs have been rejected.
>> >  - This change prevents rejected CVE references from appearing in the
>> >    generated SBOM.
>> >
>> > Fixed kernel `CONFIG_` generation in SPDX3:
>> >  - Backported a fix for the generation of kernel `CONFIG_` values in
>> >    SPDX3 output.
>> >  - This is a important fix, as the generated SBOM file might otherwise
>> >    randomly omit kernel `CONFIG_` values.
>> 
>> Hello,
>> 
>> Can you please send the equivalent series for whinlatter?
>
> Hello Yoann,
>
> I can send an "equivalent" series for whinlatter but only with the CVE
> "fixes".
> The generation of kernel `CONFIG_` values in SPDX3 output was not
> backported in whinlatter: It is only in master and Scarthgap.

Oh that's why I couldn't trivialy backport the patch (I did not look
why)

> Let me know what I need to do in this case?

I can do the cherry-pick for the 2 rejected CVE patches.

Thanks!
-- 
Yoann Congal
Smile ECS