mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-20 08:29:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

cve_check: skip remote patches that haven't been fetched when searching for CVE tags

Browse Source 
If a remote patch is compressed we need to have run the unpack task for
the file to exist locally.  Currently cve_check only depends on fetch so
instead of erroring out, emit a warning that this file won't be scanned
for CVE references.

Typically, remote compressed patches won't contain our custom tags, so
this is unlikely to be an issue.

(From OE-Core rev: b52a508bd7693c40e6416db9c9076a8789499501)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cefc8741438c91f74264da6b59dece2e31f9e5a5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ross Burton
2022-04-27 12:43:39 +01:00
committed by Richard Purdie
parent ed9500ddb6
commit 498bbee789
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
meta/lib/oe/cve_check.py
View File

@@ -89,9 +89,10 @@ def get_patched_cves(d):
for url in oe.patch.src_patches(d):
patch_file = bb.fetch.decodeurl(url)[2]
# Remote compressed patches may not be unpacked, so silently ignore them
if not os.path.isfile(patch_file):
bb.error("File Not found: %s" % patch_file)
raise FileNotFoundError
bb.warn("%s does not exist, cannot extract CVE list" % patch_file)
continue
# Check patch file name for CVE ID
fname_match = cve_file_name_match.search(patch_file)