mirror of
https://git.yoctoproject.org/poky
synced 2026-06-01 13:09:50 +00:00
meta: remove True option to getVar calls
getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) (From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Joshua Lock
committed by
Richard Purdie
Richard Purdie
parent
d5e67725ac
commit
c4e2c59088
@@ -51,7 +51,7 @@ python do_cve_check () {
|
||||
Check recipe for patched and unpatched CVEs
|
||||
"""
|
||||
|
||||
if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)):
|
||||
if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")):
|
||||
patched_cves = get_patches_cves(d)
|
||||
patched, unpatched = check_cves(d, patched_cves)
|
||||
if patched or unpatched:
|
||||
@@ -70,7 +70,7 @@ python cve_check_cleanup () {
|
||||
Delete the file used to gather all the CVE information.
|
||||
"""
|
||||
|
||||
bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE", True))
|
||||
bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE"))
|
||||
}
|
||||
|
||||
addhandler cve_check_cleanup
|
||||
@@ -83,12 +83,12 @@ python cve_check_write_rootfs_manifest () {
|
||||
|
||||
import shutil
|
||||
|
||||
if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)):
|
||||
if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")):
|
||||
bb.note("Writing rootfs CVE manifest")
|
||||
deploy_dir = d.getVar("DEPLOY_DIR_IMAGE", True)
|
||||
link_name = d.getVar("IMAGE_LINK_NAME", True)
|
||||
manifest_name = d.getVar("CVE_CHECK_MANIFEST", True)
|
||||
cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE", True)
|
||||
deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
|
||||
link_name = d.getVar("IMAGE_LINK_NAME")
|
||||
manifest_name = d.getVar("CVE_CHECK_MANIFEST")
|
||||
cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE")
|
||||
|
||||
shutil.copyfile(cve_tmp_file, manifest_name)
|
||||
|
||||
@@ -101,7 +101,7 @@ python cve_check_write_rootfs_manifest () {
|
||||
bb.plain("Image CVE report stored in: %s" % manifest_name)
|
||||
}
|
||||
|
||||
ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST', True) == '1' else ''}"
|
||||
ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
|
||||
|
||||
def get_patches_cves(d):
|
||||
"""
|
||||
@@ -110,7 +110,7 @@ def get_patches_cves(d):
|
||||
|
||||
import re
|
||||
|
||||
pn = d.getVar("PN", True)
|
||||
pn = d.getVar("PN")
|
||||
cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+")
|
||||
patched_cves = set()
|
||||
bb.debug(2, "Looking for patches that solves CVEs for %s" % pn)
|
||||
@@ -149,15 +149,15 @@ def check_cves(d, patched_cves):
|
||||
cves_patched = []
|
||||
cves_unpatched = []
|
||||
bpn = d.getVar("CVE_PRODUCT")
|
||||
pv = d.getVar("PV", True).split("git+")[0]
|
||||
pv = d.getVar("PV").split("git+")[0]
|
||||
cves = " ".join(patched_cves)
|
||||
cve_db_dir = d.getVar("CVE_CHECK_DB_DIR", True)
|
||||
cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST", True))
|
||||
cve_db_dir = d.getVar("CVE_CHECK_DB_DIR")
|
||||
cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST"))
|
||||
cve_cmd = "cve-check-tool"
|
||||
cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir]
|
||||
|
||||
# If the recipe has been whitlisted we return empty lists
|
||||
if d.getVar("PN", True) in d.getVar("CVE_CHECK_PN_WHITELIST", True).split():
|
||||
if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split():
|
||||
bb.note("Recipe has been whitelisted, skipping check")
|
||||
return ([], [])
|
||||
|
||||
@@ -210,7 +210,7 @@ def get_cve_info(d, cves):
|
||||
from pysqlite2 import dbapi2 as sqlite3
|
||||
|
||||
cve_data = {}
|
||||
db_file = d.getVar("CVE_CHECK_DB_FILE", True)
|
||||
db_file = d.getVar("CVE_CHECK_DB_FILE")
|
||||
placeholder = ",".join("?" * len(cves))
|
||||
query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder
|
||||
conn = sqlite3.connect(db_file)
|
||||
@@ -231,15 +231,15 @@ def cve_write_data(d, patched, unpatched, cve_data):
|
||||
CVE manifest if enabled.
|
||||
"""
|
||||
|
||||
cve_file = d.getVar("CVE_CHECK_LOCAL_FILE", True)
|
||||
cve_file = d.getVar("CVE_CHECK_LOCAL_FILE")
|
||||
nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId="
|
||||
write_string = ""
|
||||
first_alert = True
|
||||
bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR", True))
|
||||
bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR"))
|
||||
|
||||
for cve in sorted(cve_data):
|
||||
write_string += "PACKAGE NAME: %s\n" % d.getVar("PN", True)
|
||||
write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV", True)
|
||||
write_string += "PACKAGE NAME: %s\n" % d.getVar("PN")
|
||||
write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV")
|
||||
write_string += "CVE: %s\n" % cve
|
||||
if cve in patched:
|
||||
write_string += "CVE STATUS: Patched\n"
|
||||
@@ -257,13 +257,13 @@ def cve_write_data(d, patched, unpatched, cve_data):
|
||||
bb.note("Writing file %s with CVE information" % cve_file)
|
||||
f.write(write_string)
|
||||
|
||||
if d.getVar("CVE_CHECK_COPY_FILES", True) == "1":
|
||||
cve_dir = d.getVar("CVE_CHECK_DIR", True)
|
||||
if d.getVar("CVE_CHECK_COPY_FILES") == "1":
|
||||
cve_dir = d.getVar("CVE_CHECK_DIR")
|
||||
bb.utils.mkdirhier(cve_dir)
|
||||
deploy_file = os.path.join(cve_dir, d.getVar("PN", True))
|
||||
deploy_file = os.path.join(cve_dir, d.getVar("PN"))
|
||||
with open(deploy_file, "w") as f:
|
||||
f.write(write_string)
|
||||
|
||||
if d.getVar("CVE_CHECK_CREATE_MANIFEST", True) == "1":
|
||||
with open(d.getVar("CVE_CHECK_TMP_FILE", True), "a") as f:
|
||||
if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
|
||||
with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f:
|
||||
f.write("%s" % write_string)
|
||||
|
||||
Reference in New Issue
Block a user