Re: [docs] [PATCH v2] manuals: further documentation for cve-check

["Quentin Schulz" <quentin.schulz@theobroma-systems.com>]

Hi Michael,

On Fri, Aug 06, 2021 at 05:34:47PM +0200, Michael Opdenacker wrote:
> This adds details about the actual implementation
> of vulnerability checks, about how to fix or ignore
> vulnerabilities in recipes, and documents the
> CVE_CHECK_PN_WHITELIST and CVE_CHECK_WHITELIST variables.
> 
> Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
[...]
> diff --git a/documentation/ref-manual/classes.rst b/documentation/ref-manual/classes.rst
> index 49905f2725..274ea19e6e 100644
> --- a/documentation/ref-manual/classes.rst
> +++ b/documentation/ref-manual/classes.rst
> @@ -404,6 +404,18 @@ cross-compilation tools used for building SDKs. See the
>  section in the Yocto Project Overview and Concepts Manual for more
>  discussion on these cross-compilation tools.
>  
> +.. _ref-classes-cve-check:
> +
> +``cve-check.bbclass``
> +=====================
> +
> +The ``cve-check`` class looks for known CVE (Common Vulnerabilities
> +and Exposures) while building an image. You can also look for
> +vulnerabilities in specific packages by passing ``-c cve_check``
> +to BitBake. You will find details in the
> +":ref:`dev-manual/common-tasks:checking for vulnerabilities`"
> +section in the Development Tasks Manual.
> +

I would maybe add that this class should be inherited globally from a
configuration file with INHERIT += "cve-check" just to highlight it's
not expected to inherit it in recipe files.

In any case:
Reviewed-by: Quentin Schulz <foss@0leil.net>

Thanks!
Quentin