CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

spdx30: fix cve status for patch files in VEX

Browse Source 
This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98
which adapts vex creation between function create_spdx where all changes
were backported and funtion get_patched_cves where changes were not
backported.

CVE patches were previously ignored as they cannot be decoded from
CVE_STATUS variables and each caused a warning like:
WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — missing or unknown CVE status

Master branch uses fix-file-included for CVE patches however since
cve-check-map.conf was not part of spdx-3.0 backport, closest one
available (backported-patch) was implemented.

(From OE-Core rev: 8d14b2bb02861612130f02c445392f34090ba5d9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-11-18 13:08:39 +01:00 committed by Steve Sakoman
parent 7e8674996b
commit c06e4e6e60
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
meta/lib/oe/spdx30_tasks.py
View File

@ -503,7 +503,13 @@ def create_spdx(d):
if include_vex != "none":
patched_cves = oe.cve_check.get_patched_cves(d)
for cve_id in patched_cves:
mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id)
# decode_cve_status is decoding CVE_STATUS, so patch files need to be hardcoded
if cve_id in (d.getVarFlags("CVE_STATUS") or {}):
mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id)
else:
mapping = "Patched"
detail = "backported-patch" # fix-file-included is not available in scarthgap
description = None
if not mapping or not detail:
bb.warn(f"Skipping {cve_id} — missing or unknown CVE status")