mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
6e376f5f1a
Without this change, 0 CVEs are reported.
With this change, 8 Patched CVEs are reported:
* CVE-2014-1858
* CVE-2014-1859
* CVE-2017-12852
* CVE-2019-6446
* CVE-2021-33430
* CVE-2021-34141
* CVE-2021-41495
* CVE-2021-41496
This can be verified with a query like:
$ cat .../core-image-ptest-python3-numpy-*.rootfs.sbom-cve-check.yocto.json \
| jq '.package[] | select(.name == "python3-numpy") \
| .issue[] | {id: .id, status: .status}'
(From OE-Core rev: 5e73d32ea99d8e909bfb861a9f9c291c39497233)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ad623e71fadeddcb0b70bba8fbf28c75a976e596)
The current "python3-numpy" mapping has no matching NVD CPE or
configuration identity, so eight source-aligned CVE records are missed.
Use "numpy:numpy", the active NVD dictionary CPE and configuration
identity for the packaged NumPy source.
Note: The original commit targeted python3-numpy_2.5.2.bb. This is
adjusted for Scarthgap, where the recipe version is 1.26.4.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
67 lines
2.2 KiB
BlitzBasic
67 lines
2.2 KiB
BlitzBasic
SUMMARY = "A sophisticated Numeric Processing Package for Python"
|
|
HOMEPAGE = "https://numpy.org/"
|
|
DESCRIPTION = "NumPy is the fundamental package needed for scientific computing with Python."
|
|
SECTION = "devel/python"
|
|
LICENSE = "BSD-3-Clause & BSD-2-Clause & PSF-2.0 & Apache-2.0 & MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a752eb20459cf74a9d84ee4825e8317c"
|
|
|
|
SRCNAME = "numpy"
|
|
|
|
SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${SRCNAME}-${PV}.tar.gz \
|
|
file://0001-Don-t-search-usr-and-so-on-for-libraries-by-default-.patch \
|
|
file://0001-numpy-core-Define-RISCV-32-support.patch \
|
|
file://fix_reproducibility.patch \
|
|
file://run-ptest \
|
|
"
|
|
SRC_URI[sha256sum] = "2a02aba9ed12e4ac4eb3ea9421c420301a0c6460d9830d74a9df87efa4912010"
|
|
|
|
GITHUB_BASE_URI = "https://github.com/numpy/numpy/releases"
|
|
UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
|
|
|
|
CVE_PRODUCT = "numpy:numpy"
|
|
|
|
DEPENDS += "python3-cython-native"
|
|
|
|
inherit ptest setuptools3 github-releases
|
|
|
|
S = "${WORKDIR}/numpy-${PV}"
|
|
|
|
CLEANBROKEN = "1"
|
|
|
|
do_compile:prepend() {
|
|
export NPY_DISABLE_SVML=1
|
|
}
|
|
|
|
FILES:${PN}-staticdev += "${PYTHON_SITEPACKAGES_DIR}/numpy/core/lib/*.a ${PYTHON_SITEPACKAGES_DIR}/numpy/random/lib/*.a"
|
|
|
|
# install what is needed for numpy.test()
|
|
RDEPENDS:${PN} = "python3-unittest \
|
|
python3-difflib \
|
|
python3-pprint \
|
|
python3-pickle \
|
|
python3-shell \
|
|
python3-doctest \
|
|
python3-datetime \
|
|
python3-misc \
|
|
python3-mmap \
|
|
python3-netclient \
|
|
python3-numbers \
|
|
python3-pydoc \
|
|
python3-pkgutil \
|
|
python3-email \
|
|
python3-compression \
|
|
python3-ctypes \
|
|
python3-threading \
|
|
python3-multiprocessing \
|
|
python3-json \
|
|
"
|
|
RDEPENDS:${PN}-ptest += "python3-pytest \
|
|
python3-hypothesis \
|
|
python3-sortedcontainers \
|
|
python3-resource \
|
|
python3-typing-extensions \
|
|
ldd \
|
|
"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|