[OE-core] [PATCH 1/1] binutils: fix PV to respect upstream tag and also cve database

Chen Qi Qi.Chen at windriver.com
Thu Mar 28 12:13:35 UTC 2019


Setting PV to "2.32.0" results in cve checking tools failing to
report the actual unfixed CVEs. We need to change it to "2.32".
After the change, when `bitbake -c cve_check binutils-native', we have:

  binutils-native-2.32-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000876 CVE-2019-9070 CVE-2019-9071 CVE-2019-9072 CVE-2019-9073 CVE-2019-9074 CVE-2019-9075 CVE-2019-9076 CVE-2019-9077)

Checking the upstream repo, it has tags like:
binutils-2_29
binutils-2_29_1
binutils-2_29_1.1
binutils-2_30
binutils-2_31
binutils-2_31_1
binutils-2_32

So we'd better respect both upstream tags and cve database and use '2.32'.
If binutils 2.32.1 is released some day, we then change the PV to '2.32.1'.

Signed-off-by: Chen Qi <Qi.Chen at windriver.com>
---
 meta/recipes-devtools/binutils/binutils-2.32.inc | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/meta/recipes-devtools/binutils/binutils-2.32.inc b/meta/recipes-devtools/binutils/binutils-2.32.inc
index 7423986..b728c4e 100644
--- a/meta/recipes-devtools/binutils/binutils-2.32.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.32.inc
@@ -10,13 +10,7 @@ LIC_FILES_CHKSUM="\
     file://bfd/COPYING;md5=d32239bcb673463ab874e80d47fae504\
     "
 
-def binutils_branch_version(d):
-    pvsplit = d.getVar('PV').split('.')
-    return pvsplit[0] + "_" + pvsplit[1]
-
-PV = "2.32.0"
-BINUPV = "${@binutils_branch_version(d)}"
-#BRANCH = "binutils-${BINUPV}-branch"
+PV = "2.32"
 BRANCH ?= "binutils-2_32-branch"
 
 UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)"
-- 
1.9.1



More information about the Openembedded-core mailing list