mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-30 00:20:08 +00:00
Code Issues Projects Releases Wiki Activity

ref-manual: document CVE_STATUS and CVE_CHECK_STATUSMAP

Browse Source 
Deprecate CVE_CHECK_IGNORE with CVE_STATUS

(From yocto-docs rev: 8b8054977f31e2d6090521a0102f066b6d563733)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Andrej Valek
2023-07-20 09:31:30 +02:00
committed by Richard Purdie
parent db7217335a
commit e100e3e0b3
4 changed files with 42 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/ref-manual/classes.rst
+3 -3
View File
@@ -517,10 +517,10 @@ The ``Patched`` state of a CVE issue is detected from patch files with the forma
``CVE-ID.patch``, e.g. ``CVE-2019-20633.patch``, in the :term:`SRC_URI` and using
CVE metadata of format ``CVE: CVE-ID`` in the commit message of the patch file.
If the recipe lists the ``CVE-ID`` in :term:`CVE_CHECK_IGNORE` variable, then the CVE state is reported
as ``Ignored``. Multiple CVEs can be listed separated by spaces. Example::
If the recipe adds ``CVE-ID`` as flag of the :term:`CVE_STATUS` variable with status
mapped to ``Ignored``, then the CVE state is reported as ``Ignored``::
CVE_CHECK_IGNORE += "CVE-2020-29509 CVE-2020-29511"
CVE_STATUS[CVE-2020-15523] = "not-applicable-platform: Issue only applies on Windows"
If CVE check reports that a recipe contains false positives or false negatives, these may be
fixed in recipes by adjusting the CVE product name using :term:`CVE_PRODUCT` and :term:`CVE_VERSION` variables.