From 2d4aee3d97bdcdd48ccb2a4fd34399e13cca9e22 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Sun, 24 Nov 2024 21:13:42 +0100 Subject: cve-check: fix cvesInRecord Currently flag cvesInRecord is set to false if all CVEs are ignored or patched. This is inconsistent as it shows false if a CVE was fixed via patch and true if this CVE was fixed by upgrade. In both cases the CVE is valid and was fixed. As I understand this flag, it should say if any CVE exists for particular component's product (regardless of how this CVE is handled) and can be used to validate if a product is correctly set. Note that skipping ignored CVEs may make sense in some cases, as ignored may mean that NVD DB is wrong, but in many cases it is ignored for other reasons. Further patch can be done to evaluate ignore subtype but that would be against my understanding of this flag as described above. (From OE-Core rev: 0fb2bfb8d6c77009385d7deca2e758bdee5c9b07) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit c5d499693672ec9619392011b765941cf94aa319) Signed-off-by: Steve Sakoman --- meta/classes/cve-check.bbclass | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 33d41b912d..6e10dd915a 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -343,17 +343,18 @@ def check_cves(d, cve_data): for cverow in cve_cursor: cve = cverow[0] + # Write status once only for each product + if not cves_in_product: + cves_status.append([product, True]) + cves_in_product = True + cves_in_recipe = True + if cve_is_ignored(d, cve_data, cve): bb.note("%s-%s ignores %s" % (product, pv, cve)) continue elif cve_is_patched(d, cve_data, cve): bb.note("%s has been patched" % (cve)) continue - # Write status once only for each product - if not cves_in_product: - cves_status.append([product, True]) - cves_in_product = True - cves_in_recipe = True vulnerable = False ignored = False -- cgit v1.2.3-54-g00ecf