mirror of
https://git.yoctoproject.org/poky
synced 2026-04-18 03:32:13 +02:00
cve-check-tool: correctly exported web proxies
The binary 'cve-check-update' downloads the CVE database from the Internet. If the system is behind a web proxy, the download fails, as proxy-related variables are not exported. In turn, 'cve-check-tool' does not connect to the network and correspondingly does not need exported proxies. Exported all proxy-related environment variables to 'cve-check-update' and removed the unneeded export from 'cve-check-tool'. (From OE-Core rev: 17db210975c740aff12732c511cf4fb32b507365) Signed-off-by: Konstantin Shemyak <konstantin.shemyak@ge.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
committed by
Richard Purdie
parent
6c0c3220aa
commit
2e07b1c0bb
@@ -184,9 +184,6 @@ def check_cves(d, patched_cves):
|
||||
bb.note("Recipe has been whitelisted, skipping check")
|
||||
return ([], [])
|
||||
|
||||
# It is needed to export the proxies to download the database using HTTP
|
||||
bb.utils.export_proxies(d)
|
||||
|
||||
try:
|
||||
# Write the faux CSV file to be used with cve-check-tool
|
||||
fd, faux = tempfile.mkstemp(prefix="cve-faux-")
|
||||
|
||||
@@ -41,6 +41,7 @@ do_populate_cve_db() {
|
||||
[ -z "${cve_dir}" ] && cve_dir="${DL_DIR}/CVE_CHECK"
|
||||
[ -z "${cve_file}" ] && cve_file="${TMPDIR}/cve_check"
|
||||
|
||||
unused="${@bb.utils.export_proxies(d)}"
|
||||
bbdebug 2 "Updating cve-check-tool database located in $cve_dir"
|
||||
# --cacert works around curl-native not finding the CA bundle
|
||||
if cve-check-update --cacert ${sysconfdir}/ssl/certs/ca-certificates.crt -d "$cve_dir" ; then
|
||||
|
||||
Reference in New Issue
Block a user