[OE-core] [PATCHv4 0/2] Add initial capability to check CVEs for recipes
mariano.lopez at linux.intel.com
mariano.lopez at linux.intel.com
Wed Aug 24 18:58:33 UTC 2016
From: Mariano Lopez <mariano.lopez at linux.intel.com>
This series add the cve-check-tool recipe, a tool used to identify
potentially vulnerable software through version matching. It will
check if a vulnerability has been addressed by a patch.
Also add the new cve-check class that will add a task for all recipes
to check for CVEs using cve-check-tool. This tool can be used by recipe,
mage (will generate an image report in deploy dir), and with "world"
and "universe"
To run it just inherit the class and enter:
bitbake -c cve_check <recipe>
Changes in v2:
- Set the explicit dependency of cve-check-tool-native:do_populate_cve_db
in the cve-check class
- Squashed patch 2 into patch 1
Changes in v3:
- Support for python3
- Add check for BB_NO_NETWORK
Changes in v4:
- Support for GCC 6 adding -Wno-error=pedantic to CFLAGS
- Support for musl thanks to patch from Khem
- Tweaks when building the the CVE database
- Fix license
The following changes since commit a81b326933d15f08e06780f92d8dc0d4efb3cd23:
combo-layer: python3: fix UnicodeDecodeError (2016-08-24 13:58:28 +0100)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib mariano/bug7515v5
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=mariano/bug7515v5
Mariano Lopez (2):
cve-check-tool: Add recipe
cve-check.bbclass: Add class
meta/classes/cve-check.bbclass | 267 +++++++++++++++++++++
.../cve-check-tool/cve-check-tool_5.6.4.bb | 59 +++++
.../check-for-malloc_trim-before-using-it.patch | 51 ++++
3 files changed, 377 insertions(+)
create mode 100644 meta/classes/cve-check.bbclass
create mode 100644 meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
create mode 100644 meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch
--
2.6.6
More information about the Openembedded-core
mailing list