mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-09 17:39:31 +00:00
Code Issues Projects Releases Wiki Activity

cve-check: show real PN/PV

Browse Source 
The output currently shows the remapped product and version fields,
which may not be the actual recipe name/version. As this report is about
recipes, use the real values.

(From OE-Core rev: 18827d7f40db4a4f92680bd59ca655cca373ad65)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ross Burton
2020-11-19 10:38:09 +00:00
committed by Richard Purdie
parent 913ed9a6b1
commit 0be2aedfd3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/classes/cve-check.bbclass
+6 -3
View File
@@ -208,6 +208,9 @@ def check_cves(d, patched_cves):
""" """
from distutils.version import LooseVersion from distutils.version import LooseVersion
pn = d.getVar("PN")
real_pv = d.getVar("PV")
cves_unpatched = [] cves_unpatched = []
# CVE_PRODUCT can contain more than one product (eg. curl/libcurl) # CVE_PRODUCT can contain more than one product (eg. curl/libcurl)
products = d.getVar("CVE_PRODUCT").split() products = d.getVar("CVE_PRODUCT").split()
@@ -217,7 +220,7 @@ def check_cves(d, patched_cves):
pv = d.getVar("CVE_VERSION").split("+git")[0] pv = d.getVar("CVE_VERSION").split("+git")[0]
# If the recipe has been whitlisted we return empty lists # If the recipe has been whitlisted we return empty lists
if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split(): if pn in d.getVar("CVE_CHECK_PN_WHITELIST").split():
bb.note("Recipe has been whitelisted, skipping check") bb.note("Recipe has been whitelisted, skipping check")
return ([], [], []) return ([], [], [])
@@ -286,12 +289,12 @@ def check_cves(d, patched_cves):
vulnerable = vulnerable_start or vulnerable_end vulnerable = vulnerable_start or vulnerable_end
if vulnerable: if vulnerable:
bb.note("%s-%s is vulnerable to %s" % (product, pv, cve)) bb.note("%s-%s is vulnerable to %s" % (pn, real_pv, cve))
cves_unpatched.append(cve) cves_unpatched.append(cve)
break break
if not vulnerable: if not vulnerable:
bb.note("%s-%s is not vulnerable to %s" % (product, pv, cve)) bb.note("%s-%s is not vulnerable to %s" % (pn, real_pv, cve))
# TODO: not patched but not vulnerable # TODO: not patched but not vulnerable
patched_cves.add(cve) patched_cves.add(cve)