Skip to content
Snippets Groups Projects
  1. Apr 08, 2022
  2. Apr 07, 2022
  3. Apr 05, 2022
  4. Apr 04, 2022
  5. Apr 01, 2022
  6. Mar 30, 2022
    • Marta Rybczynska's avatar
      cve-check: add YAML output · 19931c39
      Marta Rybczynska authored
      This patch implements the YAML output for CVE-check and re-implements
      the coverage pass using this format (also simplifies the logic).
      
      Add an option to output the CVE check in a JSON-based format.
      This format is easier to parse in software than the original
      text-based one and allows post-processing by other tools.
      
      Output formats are now handed by CVE_CHECK_FORMAT_TEXT and
      CVE_CHECK_FORMAT_JSON. Both of them are enabled by default.
      
      The JSON output format gets generated in a similar way to the
      text format with the exception of the manifest: appending to
      JSON arrays requires parsing the file. Because of that we
      first write JSON fragments and then assemble them in one pass
      at the end.
      
      Until now the CVE checker was giving information about CVEs found for
      a product (or more products) contained in a recipe. However, there was
      no easy way to find out which products or recipes have no CVEs. Having
      no reported CVEs might mean there are simply none, but can also mean
      a product name (CPE) mismatch.
      
      This patch adds CVE_CHECK_COVERAGE option enabling a new type of
      statistics. Then we use the new JSON format to report the information.
      The legacy text mode report does not contain it.
      
      This option is expected to help with an identification of recipes with
      mismatched CPEs, issues in the database and more.
      
      This work is based on [1], but adding the JSON format makes it easier
      to implement, without additional result files.
      
      [1] https://lists.openembedded.org/g/openembedded-core/message/159873
      
      This is a backported version of two patches submitted upstream:
      https://lists.openembedded.org/g/openembedded-core/message/163745 and
      https://lists.openembedded.org/g/openembedded-core/message/163746
      
      
      
      The difference is that we bring back the yaml merge function that is
      in the lib/ directory in the upstream proposal.
      
      Signed-off-by: default avatarMarta Rybczynska <marta.rybczynska@huawei.com>
      19931c39
    • Marta Rybczynska's avatar
      cve-check: update class · 35e75415
      Marta Rybczynska authored
      
      Update the class to OE-core 6002bdc77643c363a8326bf163baecba8b36e3e0.
      
      This includes:
      - inclusive language changes
      - the rework of the database lock
      
      Signed-off-by: default avatarMarta Rybczynska <marta.rybczynska@huawei.com>
      35e75415
  7. Mar 29, 2022
  8. Mar 25, 2022
  9. Mar 24, 2022
Loading