I can't tell, if this runs on every bitbake/compilation of the kernel, then this is a hard NACK.
Make a task for it, or just add instructions on how to generate these, but it cannot be in the standard build set of tasks. Bruce On Tue, Jan 6, 2026 at 1:28 PM vboudevin via lists.openembedded.org <[email protected]> wrote: > Add a .bbclass to generate-cve-exclusions to use this script at every > run. > This class needs to be inherit by the linux kernel recipe. > > This class contains several methods: > > *do_clone_cvelistV5: Clone the cvelistV5 repo in > ${WORKDIR}/cvelistV5/git > > (e.g. bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/ > linux-yocto/6.18.1+git/cvelistV5/git) > > *do_generate_cve_exclusions: Use the script generate-cve-exclusions.py. > It uses the new "--output-json" argument to generate a JSON file as an > output stored in ${WORKDIR}/cvelistV5//cve-exclusion_${LINUX_VERSION}.json > > *do_cve_check:prepend: Parse the previously generated JSON file to set > the variable CVE_STATUS corretly > --- > meta/classes/generate-cve-exclusions.bbclass | 67 ++++++++++++++++++++ > 1 file changed, 67 insertions(+) > create mode 100644 meta/classes/generate-cve-exclusions.bbclass > > diff --git a/meta/classes/generate-cve-exclusions.bbclass > b/meta/classes/generate-cve-exclusions.bbclass > new file mode 100644 > index 0000000000..3e34ba563d > --- /dev/null > +++ b/meta/classes/generate-cve-exclusions.bbclass > @@ -0,0 +1,67 @@ > +CVE_EXCLUSIONS_WORKDIR ?= "${WORKDIR}/cvelistV5" > +CVELISTV5_PATH ?= "${CVE_EXCLUSIONS_WORKDIR}/git" > + > +python do_clone_cvelistV5() { > + import subprocess > + import shutil, os > + rootdir = d.getVar("CVELISTV5_PATH") > + d.setVar("SRC_URI", "git:// > github.com/CVEProject/cvelistV5.git;branch=main;protocol=https") > + d.setVar("SRCREV", "${AUTOREV}") > + src_uri = (d.getVar('SRC_URI') or "").split() > + # Fetch the kernel vulnerabilities sources > + fetcher = bb.fetch2.Fetch(src_uri, d) > + fetcher.download() > + # Unpack into the standard work directory > + fetcher.unpack(rootdir) > + # Remove the folder ${PN} set by unpack > + subdirs = [d for d in os.listdir(rootdir) if > os.path.isdir(os.path.join(rootdir, d))] > + if len(subdirs) == 1: > + srcdir = os.path.join(rootdir, subdirs[0]) > + for f in os.listdir(srcdir): > + shutil.move(os.path.join(srcdir, f), rootdir) > + shutil.rmtree(srcdir) > + bb.note("Vulnerabilities repo unpacked into: %s" % rootdir) > +} > +do_clone_cvelistV5[network] = "1" > +do_clone_cvelistV5[nostamp] = "1" > +do_clone_cvelistV5[doc] = "Clone CVE information from the CVE Project: > https://github.com/CVEProject/cvelistV5.git"; > +addtask clone_cvelistV5 after do_fetch before do_generate_cve_exclusions > + > +do_generate_cve_exclusions() { > + generate_cve_exclusions_script=$(find ${COREBASE} -name > "generate-cve-exclusions.py") > + if [ -z "${generate_cve_exclusions_script}" ]; then > + bbfatal "generate-cve-exclusions.py not found in ${COREBASE}." > + fi > + python3 "${generate_cve_exclusions_script}" \ > + ${CVELISTV5_PATH} \ > + ${LINUX_VERSION} \ > + --output-json > > ${CVE_EXCLUSIONS_WORKDIR}/cve-exclusion_${LINUX_VERSION}.json > +} > +do_generate_cve_exclusions[nostamp] = "1" > +do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel > build. (e.g., cve-exclusion_6.12.inc)" > +addtask generate_cve_exclusions after do_clone_cvelistV5 before > do_cve_check > + > +python do_cve_check:prepend() { > + import os > + import json > + > + workdir = d.getVar("CVE_EXCLUSIONS_WORKDIR") > + kernel_version = d.getVar("LINUX_VERSION") > + json_input_file = os.path.join(workdir, "cve-exclusion_%s.json" % > kernel_version) > + > + # Parse JSON > + with open(json_input_file, 'r', encoding='utf-8') as f: > + cve_data = json.load(f) > + > + cve_status_dict = cve_data.get("cve_status", {}) > + > + if os.path.exists(json_input_file): > + count = 0 > + for cve_id, info in cve_status_dict.items(): > + if info.get("active", True): > + # Skip active CVEs > + continue > + d.setVarFlag("CVE_STATUS", cve_id, info.get("message", "")) > + count += 1 > + bb.note("Loaded %d CVE_STATUS entries from JSON output for kernel %s" > % (count, kernel_version)) > +} > \ No newline at end of file > -- > 2.43.0 > > > > > -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#228913): https://lists.openembedded.org/g/openembedded-core/message/228913 Mute This Topic: https://lists.openembedded.org/mt/117110144/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
