Re: [PATCH v2 2/2] sbom-cve-check-update-db: Fix unpack removing other databases

["Antonin Godard" <antonin.godard@bootlin.com>]

Hi,

On Tue Apr 7, 2026 at 5:01 PM CEST, Benjamin Robin wrote:
> Previously, `UNPACKDIR` was set to `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}`,
> which points to the `./databases/` directory and may contain multiple
> databases. Since `do_unpack` cleans the `${UNPACKDIR}` directory,
> `UNPACKDIR` must only contain a single database.
>
> To address this, set `UNPACKDIR` to
> `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}/${SBOM_CVE_CHECK_DB_NAME}` and
> configure `destsuffix` to an empty string. However, it is currently not
> possible to set `BB_GIT_DEFAULT_DESTSUFFIX` to an empty string, so
> `destsuffix` is configured through the SRC_URI instead.

I've tested this the following way, first by unpacking the databases with:

SRCREV:pn-sbom-cve-check-update-nvd-native = "ba5e43861ba2ca0f7968597c27c6a412c1bfa8c2"
SRCREV:pn-sbom-cve-check-update-cvelist-native = "6740b38b3e0692bb9c96eb226371ae9e1217c1fd"

Then created a random file in the nvd database checkout:

touch tmp/deploy/sbom-cve-check/databases/nvd-fkie/file.txt

Then I updated the sha for cvelist only:

SRCREV:pn-sbom-cve-check-update-nvd-native = "ba5e43861ba2ca0f7968597c27c6a412c1bfa8c2"
SRCREV:pn-sbom-cve-check-update-cvelist-native = "42e75c927b155335cb1119df9d9b85a58732ad1e"

Ran the unpack again, and file.txt is still there.

Doing the same without this patch, you'd get:

$ ls -l tmp/deploy/sbom-cve-check/databases/nvd-fkie
"tmp/deploy/sbom-cve-check/databases/nvd-fkie": No such file or directory (os error 2)

This fixes the issue for me too, so feel free to add:

Tested-by: Antonin Godard <antonin.godard@bootlin.com>

Antonin