mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-16 00:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

spdx30: Allow VEX Justification to be configurable

Browse Source 
Instead of hard coding the VEX justifications for "Ignored" CVE status,
add a map that configures what justification should be used for each
status.

This allows other justifications to be easily added, and also ensures
that status fields added externally (by downstream) can set an
appropriate justification if necessary.

(From OE-Core rev: c0fa3d92cefa74fa57c6c48c94acc64aa454e781)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Joshua Watt
2025-07-02 10:43:28 -06:00
committed by Richard Purdie
parent 2fef1b9af0
commit 860aedadc9
2 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
meta/lib/oe/spdx30_tasks.py
View File

@@ -724,24 +724,23 @@ def create_spdx(d):
impact_statement=description,
)
if detail in (
"ignored",
"cpe-incorrect",
"disputed",
"upstream-wontfix",
):
# VEX doesn't have justifications for this
pass
elif detail in (
"not-applicable-config",
"not-applicable-platform",
):
for v in spdx_vex:
v.security_justificationType = (
oe.spdx30.security_VexJustificationType.vulnerableCodeNotPresent
vex_just_type = d.getVarFlag(
"CVE_CHECK_VEX_JUSTIFICATION", detail
)
if vex_just_type:
if (
vex_just_type
not in oe.spdx30.security_VexJustificationType.NAMED_INDIVIDUALS
):
bb.fatal(
f"Unknown vex justification '{vex_just_type}', detail '{detail}', for ignored {cve}"
)
else:
bb.fatal(f"Unknown detail '{detail}' for ignored {cve}")
for v in spdx_vex:
v.security_justificationType = oe.spdx30.security_VexJustificationType.NAMED_INDIVIDUALS[
vex_just_type
]
elif status == "Unknown":
bb.note(f"Skipping {cve} with status 'Unknown'")
else: