summaryrefslogtreecommitdiffstats
path: root/meta/classes/cve-check.bbclass
Commit message (Collapse)AuthorAgeFilesLines
* cve-check: write the cve manifest to IMGDEPLOYDIRJermain Horsman2023-01-181-3/+3
| | | | | | | | | | | | | | | | When building an image cve_check_write_rootfs_manifest() would sometimes fail with a FileNotFoundError when writing the manifest.cve due to the parent directory (DEPLOY_DIR_IMAGE) not (yet) existing. The image task will provide the manifest in the deploy directory afterwards, so other recipes depending on the manifest being in DEPLOY_DIR_IMAGE should continue to function properly. (From OE-Core rev: 00fb2aae22ce0d7ff5f3f8766fa770eeb4e73483) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: close cursors as soon as possibleRoss Burton2022-09-021-4/+9
| | | | | | | | | | | | | | We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: cve-check: Get shared database lockJoshua Watt2022-08-311-11/+12
| | | | | | | | | | | | | The CVE check database needs to have a shared lock acquired on it before it is accessed. This to prevent cve-update-db-native from deleting the database file out from underneath it. [YOCTO #14899] (From OE-Core rev: 20a9911b73df62a0d0d1884e57085f13ac5016dd) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Add SPDX license identifiersRichard Purdie2022-08-121-0/+2
| | | | | | | | | | | | As stated in our top level license files, the license is MIT unless otherwise stated. Add SPDX identifers accordingly. Replace older license statementa with the standardised syntax. Also drop "All Rights Reserved" expression as it isn't used now, doesn't mean anything and is confusing. (From OE-Core rev: 081a391fe09a21265881e39a2a496e4e10b4f80b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Add copyright statements to files without oneRichard Purdie2022-08-121-0/+4
| | | | | | | | | Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: hook cleanup to the BuildCompleted event, not CookerExitRoss Burton2022-06-301-1/+1
| | | | | | | | | | | | | | | | | | The cve-check class writes temporary files to preserve state across the build, and cleans them up in a CookerExit handler. However, in memory-resident builds the cooker won't exit in between builds, so the state isn't cleared and the CVE report generation fails: NOTE: Generating JSON CVE summary ERROR: Error adding the same package twice Easily solved by hooking to BuildCompleted, instead of CookerExit. (From OE-Core rev: fccdcfd301de281a427bfee48d8ff47fa07b7259) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add support for Ignored CVEsMarta Rybczynska2022-06-171-13/+30
| | | | | | | | | | | | | | | | Ignored CVEs aren't patched, but do not apply in our configuration for some reason. Up till now they were only partially supported and reported as "Patched". This patch adds separate reporting of Ignored CVEs. The variable CVE_CHECK_REPORT_PATCHED now manages reporting of both patched and ignored CVEs. (From OE-Core rev: c773102d4828fc4ddd1024f6115d577e23f1afe4) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: fix return type in check_cvesMarta Rybczynska2022-06-061-1/+1
| | | | | | | | | Make empty return types in check_cvs the same for all code paths. (From OE-Core rev: f86393c93dec47b24e837d0c4c5761a716ecdbb6) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: write empty fragment files in the text modeMarta Rybczynska2022-06-061-14/+13
| | | | | | | | | | | | | | | | | In the cve-check text mode output, we didn't write fragment files if there are no CVEs (if CVE_CHECK_REPORT_PATCHED is 1), or no unpached CVEs otherwise. However, in a system after multiple builds, cve_check_write_rootfs_manifest might find older files and use them as current, what leads to incorrect reporting. Fix it by always writing a fragment file, even if empty. (From OE-Core rev: f1b7877acd0f6e3626faa57d9f89809cfcdfd0f1) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: move update_symlinks to a libraryMarta Rybczynska2022-06-061-8/+3
| | | | | | | | | Move the function to a library, it could be useful in other places. (From OE-Core rev: debd37abcdde8788761ebdb4a05bc61f7394cbb8) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Allow warnings to be disabledRichard Purdie2022-05-291-1/+2
| | | | | | | | | | When running CVE checks in CI we're usually not interested in warnings on the console for any CVEs present. Add a configuration option CVE_CHECK_SHOW_WARNINGS to allow this to be disabled (it is left enabled by default). (From OE-Core rev: 1054d3366ba528f2ad52585cf951e508958c5c68) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Only include installed packages for rootfs manifestErnst Sjöstrand2022-05-271-15/+54
| | | | | | | | | | | | | | Before this the rootfs manifest and the summary were identical. We should separate the summary and rootfs manifest more clearly, now the summary is for all CVEs and the rootfs manifest is only for things in that image. This is even more useful if you build multiple images. (From OE-Core rev: 3b8cc6fc45f0ea5677729ee2b1819bdc7a441ab1) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Add helper for symlink handlingErnst Sjöstrand2022-05-271-21/+13
| | | | | | | | (From OE-Core rev: 5046d54df2c3057be2afa4143a2833183fca0d67) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check.bbclass: Added do_populate_sdk[recrdeptask].leimaohui2022-05-231-0/+1
| | | | | | | | | | As product, sdk should do cve check as well as rootfs. (From OE-Core rev: cc17753935c5f9e08aaa6c5886f059303147c07b) Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Fix report generationMarta Rybczynska2022-05-171-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The addition of summary output caused two issues: error when building an image and the fact that JSON output was generated even when CVE_CHECK_FORMAT_JSON. When generating an image it caused an error like: ERROR: core-image-minimal-1.0-r0 do_rootfs: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:cve_check_write_rootfs_manifest(d) 0003: File: '/home/alexk/poky/meta/classes/cve-check.bbclass', lineno: 213, function: cve_check_write_rootfs_manifest 0209: 0210: link_path = os.path.join(deploy_dir, "%s.json" % link_name) 0211: manifest_path = d.getVar("CVE_CHECK_MANIFEST_JSON") 0212: bb.note("Generating JSON CVE manifest") *** 0213: generate_json_report(json_summary_name, json_summary_link_name) 0214: bb.plain("Image CVE JSON report stored in: %s" % link_path) 0215:} 0216: 0217:ROOTFS_POSTPROCESS_COMMAND:prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" Exception: NameError: name 'json_summary_name' is not defined The fix is to pass the d variable to the pure python function generate_json_report to get correct values of variables and add conditions for the JSON output where needed. In addition clarify the message presenting the summary JSON file, which isn't related to an image. Uses partial fixes from Alex Kiernan, Ernst Sjöstrand (ernstp), and Davide Gardenal. Fixes: f2987891d315 ("cve-check: add JSON format to summary output") (From OE-Core rev: 9015dec93233c7d45fd0c9885ff5d4ec23ad377d) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: fix symlinks where link and output path are equalDavide Gardenal2022-05-041-8/+11
| | | | | | | | | | | | An if statement now checks if the link and output path are the same, if they are then the link is not created, otherwise it is. (From OE-Core rev: 2f024c0236c4806f0e59e4ce51a42f6b80fdf1b3) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add JSON format to summary outputDavide Gardenal2022-05-041-18/+33
| | | | | | | | | | | | Create generate_json_report including all the code used to generate the JSON manifest file. Add to cve_save_summary_handler the ability to create the summary in JSON format. (From OE-Core rev: f2987891d315466b7ef180ecce81d15320ce8487) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: no need to depend on the fetch taskRoss Burton2022-04-281-1/+1
| | | | | | | | | | The only part of the cve-check task which needs files is the patch examination, and typically these patches are local so fetch isn't needed. (From OE-Core rev: 2c9b3186d3b7c18cbea239ab9b06e85b7c243b54) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add coverage statistics on recipes with/without CVEsMarta Rybczynska2022-03-301-11/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | Until now the CVE checker was giving information about CVEs found for a product (or more products) contained in a recipe. However, there was no easy way to find out which products or recipes have no CVEs. Having no reported CVEs might mean there are simply none, but can also mean a product name (CPE) mismatch. This patch adds CVE_CHECK_COVERAGE option enabling a new type of statistics. Then we use the new JSON format to report the information. The legacy text mode report does not contain it. This option is expected to help with an identification of recipes with mismatched CPEs, issues in the database and more. This work is based on [1], but adding the JSON format makes it easier to implement, without additional result files. [1] https://lists.openembedded.org/g/openembedded-core/message/159873 (From OE-Core rev: d1849a1facd64fa0bcf8336a0ed5fbf71b2e3cb5) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add json formatMarta Rybczynska2022-03-301-1/+143
| | | | | | | | | | | | | | | | | | | | | Add an option to output the CVE check in a JSON-based format. This format is easier to parse in software than the original text-based one and allows post-processing by other tools. Output formats are now handed by CVE_CHECK_FORMAT_TEXT and CVE_CHECK_FORMAT_JSON. Both of them are enabled by default. The JSON output format gets generated in a similar way to the text format with the exception of the manifest: appending to JSON arrays requires parsing the file. Because of that we first write JSON fragments and then assemble them in one pass at the end. (From OE-Core rev: df567de36ae5964bee433ebb97e8bf702034994a) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/scripts: Improve internal variable namingSaul Wold2022-03-101-15/+16
| | | | | | | | | Update internal variable names to improve the terms used. (From OE-Core rev: f408068e5d7998ae165f3002e51bc54b380b8099) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "cve-check: add lockfile to task"Ross Burton2022-02-271-1/+0
| | | | | | | | | | | | | | | Now that all of the functions in cve-check open the database read-only, we can remove this lockfile. This means cve-check can run in parallal again, improving runtimes massively. This reverts commit d55fbf4779483d2cfd71df78d0f733b599fef739. (From OE-Core rev: d3d3e7b324698ec3e6fce1951aba389805f3edd3) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: get_cve_info should open the database read-onlyRoss Burton2022-02-251-1/+2
| | | | | | | | | | | | All of the function in cve-check should open the database read-only, as the only writer is the fetch task in cve-update-db. However, get_cve_info() was failing to do this, which might be causing locking issues with sqlite. (From OE-Core rev: 8de517238f1f418d9af1ce312d99de04ce2e26fc) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/scripts: Automated conversion of OE renamed variablesRichard Purdie2022-02-211-5/+5
| | | | | | (From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: create directory of CVE_CHECK_MANIFEST before copyStefan Herbrechtsmeier2022-02-071-0/+1
| | | | | | | | | | Create directory of the CVE_CHECK_MANIFEST variable before copy to it, so that the variable can use an arbitrary directory name. (From OE-Core rev: 9829c16301bf2dce39fa046401a984f112fa0322) Signed-off-by: Stefan Herbrechtsmeier <stefan.herbrechtsmeier@weidmueller.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add lockfile to taskKonrad Weihmann2022-01-081-0/+1
| | | | | | | | | | | | | | | | | | | this should prevent running into the very rare error sqlite3.OperationalError: attempt to write a readonly database As highlighted by https://www.sqlite.org/faq.html#q5 it is likely that the adapter won't allow use multiple exec calls at the same time. So it's best to prevent multiple accesses at a time, by reusing the already in place CVE_CHECK_DB_FILE_LOCK YOCTO #14110 (From OE-Core rev: 677f5741bd265be49d4a5bb933b3e8d8c4eec653) Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/cve-check: Move get_patches_cves to libraryJoshua Watt2021-08-131-60/+2
| | | | | | | | | | | | | | Moving the function will allow other classes to capture which CVEs have been patched, in particular SBoM generation. Also add a function to capture the CPE ID from the CVE Product and Version (From OE-Core rev: 75d34259a715120be1d023e4fd7b6b4b125f2443) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: remove deprecated CVE_CHECK_CVE_WHITELISTMichael Opdenacker2021-08-121-3/+0
| | | | | | | | | This variable has been deprecated since Yocto Project version 3.0. (From OE-Core rev: f8ac58568b2dceef54a743369460019b3a3eeccd) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: improve comment about CVE patch file namesMichael Opdenacker2021-08-061-3/+6
| | | | | | | (From OE-Core rev: 8aa613480663e11ecc62278d8c57ca719eb23899) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: update link to NVD website for CVE detailsMichael Opdenacker2021-08-061-1/+1
| | | | | | | | | | | | The old URL schema https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-ID now redirects to https://nvd.nist.gov/vuln/detail/CVE-ID (From OE-Core rev: 57adb57a9d9b08c08ab606ec7b561792e4f4ff2d) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: fix commentsMichael Opdenacker2021-08-061-4/+4
| | | | | | | | | | | This implements various fixes in comments in cve-check.bbclass In particular, the "whitlisted" typo is important as the "whitelisted" word is going to be replaced in a near future. (From OE-Core rev: 5eecd2bf942254d08c252388594e5ec7ae330f45) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Convert to new override syntaxRichard Purdie2021-08-021-1/+1
| | | | | | | | | | | | This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add include/exclude layersakuster2021-02-091-0/+17
| | | | | | | | | | | | | | There are times when exluding or including a layer may be desired. This provide the framwork for that via two variables. The default is all layers in bblayers. CVE_CHECK_LAYER_INCLUDELIST CVE_CHECK_LAYER_EXCLUDELIST (From OE-Core rev: 5fdde65ef58b4c1048839e4f9462b34bab36fc22) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check.bbclass: add layer to cve logakuster2021-02-091-0/+4
| | | | | | | | | | Lets include whcih layer a package belongs to and add it to the cve logs (From OE-Core rev: 00d965bb42dc427749a4c3985af56ceffff80457) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve_check: add CVE_VERSION_SUFFIX to indicate suffix in versioningLee Chee Yang2021-01-301-4/+8
| | | | | | | | | | | | | | | | | | add CVE_VERSION_SUFFIX to indicate the version suffix type, currently works in two value, "alphabetical" if the version string uses single alphabetical character suffix as incremental release, blank to not consider the unidentified suffixes. This can be expand when more suffix pattern identified. refactor cve_check.Version class to use functools and add parameter to handle suffix condition. Also update testcases to cover new changes. (From OE-Core rev: 5dfd5ad5144708b474ef31eaa89a846c57be8ac0) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: replace Looseversion with custom version classLee Chee Yang2021-01-231-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | The way distutils.version.LooseVersion compare version are tricky, it treat all these ( "1.0-beta2", "1.0-rc1", "1.0A", "1.0p2" and "1.0pre1") as greater version than "1.0". This might be right for "1.0A" and "1.0p1" but not for the rest, also these version could be confusing, the "p" in "1.0p1" can be "pre" or "patched" version or even other meaning. Replace Looseversion with custom class, it uses regex to capture common version format like "1.1.1" or tag format using date like "2020-12-12" as release section, check for following known string/tags ( beta, rc, pre, dev, alpha, preview) as pre-release section, any other trailing characters are difficult to understand/define so ignore them. Compare release section and pre-release section saperately. included selftest for the version class. [YOCTO#14127] (From OE-Core rev: 6ced85e9ddd3569240f1e8b82130d1ac0fffbc40) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: show real PN/PVRoss Burton2020-11-241-3/+6
| | | | | | | | | | | The output currently shows the remapped product and version fields, which may not be the actual recipe name/version. As this report is about recipes, use the real values. (From OE-Core rev: 18827d7f40db4a4f92680bd59ca655cca373ad65) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: add CVE_CHECK_REPORT_PATCHED variable to suppress reporting of ↵Chris Laplante2020-09-301-16/+22
| | | | | | | | | | | | | patched CVEs Default behavior is not changed. To suppress patched CVEs, set: CVE_CHECK_REPORT_PATCHED = "" (From OE-Core rev: 05bd9f1f006cf94cf5324f96df29cd5862abaf45) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: introduce CVE_CHECK_RECIPE_FILE variable to allow changing of ↵Chris Laplante2020-09-301-4/+4
| | | | | | | | | | | | | | | per-recipe check file The addition of this variable also makes it possible to change the output suffix of the check files, e.g. in local.conf: CVE_CHECK_MANIFEST_append = ".txt" CVE_CHECK_RECIPE_FILE_append = ".txt" (From OE-Core rev: 0d40f1482c6d87785ae47c46c2305e1df46f459a) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use fetch taskRoss Burton2020-09-121-1/+1
| | | | | | | | | | Instead of inventing a new task to fetch the CVE data, use the existing fetch task. (From OE-Core rev: f5f97d33a1703d75b9fd9760f2c7767081538e00) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: avoid FileNotFoundError if no do_cve_check task has runChris Laplante2020-09-101-6/+7
| | | | | | | | | | For example, if you just run 'bitbake cve-update-db-native' in a clean build system, |cve_tmp_file| won't exist yet. (From OE-Core rev: dd4473f3d8e1c1a587b6de660775e4b46ddc5fad) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check/cve-update-db-native: use lockfile to fix usage under multiconfigChris Laplante2020-09-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously CVE_CHECK_DB_FILE / CVE_CHECK_DB_DIR was the same across multiconfigs which led to a race condition wherein multiple cve-update-db-native:do_populate_cve_db tasks could attempt to write to the same sqlite database. This led to the following task failure: Error executing a python function in exec_python_func() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_python_func() autogenerated', lineno: 2, function: <module> 0001: *** 0002:do_populate_cve_db(d) 0003: File: '/mnt/data/agent/work/74f119cccb44f133/yocto/sources/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 103, function: do_populate_cve_db 0099: if year == date.today().year: 0100: cve_f.write('CVE database update : %s\n\n' % date.today()) 0101: 0102: cve_f.close() *** 0103: conn.commit() 0104: conn.close() 0105:} 0106: 0107:def initialize_db(c): Exception: sqlite3.OperationalError: disk I/O error Use a lockfile to ensure multiple tasks don't step over each other. (From OE-Core rev: 24e9380643a2ae3fcae193519cb64aedaf682153) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check.bbclass: always save cve reportakuster2020-07-181-0/+32
| | | | | | | | | | | | | The cve-check file should be saved always, it has good info. Put a copy in the log dir as cve-summary with symlinks to latest run. [Yocto #13974] (From OE-Core rev: 859849c7b594d844819ad8c3f7d8325388d94b93) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: include epoch in product version outputRalph Siemsen2020-06-041-1/+1
| | | | | | | | | | | | In the generated cve.log files, include the epoch in the product version. This better matches how versions are displayed elsewhere, in particular the bb.warn("Found unpatched CVE...") that appears on the terminal when CVEs are found. (From OE-Core rev: e1c3c0b6e5b01304e2127f5058986697e82adf93) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Run it after do_fetchKhem Raj2020-05-241-1/+1
| | | | | | | | | | | | | | | | Certain recipes e.g. bash readline ( from meta-gplv2 ) download patches instead of having them in metadata, this could fail cve_check ERROR: readline-5.2-r9 do_cve_check: File Not found: qemuarm/build/../downloads/readline52-001 This patch ensures that download is done before running CVE scan, even though these will be external patches and may not contain CVE tags as it expects, but it will fix the run failures as seen above (From OE-Core rev: e406fcb6c609a0d2456d7da0d2406d2d9fa52dd2) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: CPE version '-' as all versionLee Chee Yang2020-04-011-1/+1
| | | | | | | | | | | | | | | | | | CPE version could be '-' to mean no version info. Current cve_check treat it as not valid and does not report these CVE but some of these could be a valid vulnerabilities. Since non-valid CVE can be whitelisted, so treat '-' as all version and report all these CVE to capture possible vulnerabilities. Non-valid CVE to be whitelisted separately. [YOCTO #13617] (From OE-Core rev: c69ee3594079589d27c10db32bc288566ebde9ef) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: fix ValueErrorChee Yang Lee2020-03-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | fix below error for whitelisted recipe and recipe skip cve check. Error: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_python_func() autogenerated', lineno: 2, function: <module> 0001: *** 0002:do_cve_check(d) 0003: File: '/poky-master/meta/classes/cve-check.bbclass', lineno: 59, function: do_cve_check 0055: try: 0056: patched_cves = get_patches_cves(d) 0057: except FileNotFoundError: 0058: bb.fatal("Failure in searching patches") *** 0059: whitelisted, patched, unpatched = check_cves(d, patched_cves) 0060: if patched or unpatched: 0061: cve_data = get_cve_info(d, patched + unpatched) 0062: cve_write_data(d, patched, unpatched, whitelisted, cve_data) 0063: else: Exception: ValueError: not enough values to unpack (expected 3, got 2) (From OE-Core rev: 64a362bd2dd0b4f3165d5162adbc600826af66f8) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: show whitelisted statusChee Yang Lee2020-03-071-5/+7
| | | | | | | | | | | change whitelisted CVE status from "Patched" to "Whitelisted". [Yocto #13687] (From OE-Core rev: 181bdd670492525f9488d52c3ebb9a1b142e35ea) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: fail gracefully when file not foundArmin Kuster2019-12-281-1/+8
| | | | | | | | | | | | | With out these changes, a traceback displayed when a file is listed in the SRC_URI but the file does not exist. raise FileNotFoundError and print the patch then mark the task as failed. (From OE-Core rev: d4926c11a4ab9148bdb640a9367c9e1891491a5b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Switch to NVD CVE JSON feed version 1.1Niko Mauno2019-12-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to recently released version 1.1 of NVD CVE JSON feed, as in https://nvd.nist.gov/General/News/JSON-1-1-Vulnerability-Feed-Release it is mentioned that Due to changes required to support CVSS v3.1 scoring, the JSON vulnerability feeds must be modified. This will require the consumers of this data to update their internal processes. We will be providing the JSON 1.1 schema on the data feeds page and the information below to prepare for this transition. ... The JSON 1.1 data feeds will be available on September 9th, 2019. At that time the current JSON 1.0 data feeds will no longer available. This change was tested briefly by issuing 'bitbake core-image-minimal' with 'cve-check.bbclass' inherited via local.conf, and then comparing the content between the resulting two 'DEPLOY_DIR_IMAGE/core-image-minimal-qemux86.cve' files, which did not seem to contain any other change, except total of 167 entries like CVSS v3 BASE SCORE: 0.0 were replaced with similar 'CVSS v3 BASE SCORE:' entries which had scores that were greater than '0.0' (up to '9.8'). (From OE-Core rev: cc20e4d8ff2f3aa52a2658404af9a0ff358cc323) Signed-off-by: Niko Mauno <niko.mauno@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 09:00:31 +0000