Add a .bbclass to generate-cve-exclusions to use this script at every
run.
Two steps for testing:
1) Inherit this class in the kernel recipe with "inherit
generate-cve-exclusions.bbclass"
2) Use the following command to generate a cvelistV5 entry with a JSON
file in in ${WORKDIR}/cvelistV5/ :
"bitbake linux-yocto -c generate-cve-exclusions"
The JSON file can then be parsed in the following run by cve-check.
This class contains several methods:
*do_clone_cvelistV5: Clone the cvelistV5 repo in
${WORKDIR}/cvelistV5/git
(e.g. bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/
linux-yocto/6.18.1+git/cvelistV5/git)
*do_generate_cve_exclusions: Use the script generate-cve-exclusions.py.
It uses the new "--output-json" argument to generate a JSON file as an
output stored in ${WORKDIR}/cvelistV5//cve-exclusion_${LINUX_VERSION}.json
*do_cve_check:prepend: Parse the previously generated JSON file to set
the variable CVE_STATUS corretly
The class also provides some variables:
*GENERATE_CVE_EXCLUSIONS_SRC_URI and GENERATE_CVE_EXCLUSIONS_SRCREV can
be used to change the source repository or fix a commit with SRCREV
(usefull for deterministic testing)
*GENERATE_CVE_EXCLUSIONS_NETWORK can be set to 0 to provide an offline
mode based on DL_DIR directory.
*GENERATE_CVE_EXCLUSIONS_WORKDIR path used as a working directory for
this class
Signed-off-by: Valentin Boudevin <[email protected]>
---
meta/classes/generate-cve-exclusions.bbclass | 97 ++++++++++++++++++++
1 file changed, 97 insertions(+)
create mode 100644 meta/classes/generate-cve-exclusions.bbclass
diff --git a/meta/classes/generate-cve-exclusions.bbclass
b/meta/classes/generate-cve-exclusions.bbclass
new file mode 100644
index 0000000000..163f23ecee
--- /dev/null
+++ b/meta/classes/generate-cve-exclusions.bbclass
@@ -0,0 +1,97 @@
+GENERATE_CVE_EXCLUSIONS_SRC_URI ?=
"git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix=git"
+GENERATE_CVE_EXCLUSIONS_SRCREV ?= "${@bb.fetch2.get_autorev(d)}"
+GENERATE_CVE_EXCLUSIONS_NETWORK ?= "1"
+GENERATE_CVE_EXCLUSIONS_WORKDIR ?= "${WORKDIR}/cvelistV5"
+
+SRC_URI:append = "
${GENERATE_CVE_EXCLUSIONS_SRC_URI};name=generate-cve-exclusions"
+SRCREV_generate-cve-exclusions = "${GENERATE_CVE_EXCLUSIONS_SRCREV}"
+
+python do_clone_cvelistV5() {
+ import subprocess
+ import shutil, os
+ network_allowed = d.getVar("GENERATE_CVE_EXCLUSIONS_NETWORK") == "1"
+ rootdir = d.getVar("GENERATE_CVE_EXCLUSIONS_WORKDIR")
+ # Remove existing unpacked directory if any
+ if os.path.exists(rootdir):
+ shutil.rmtree(rootdir)
+ # Prepare fetcher
+ src_uri_list = (d.getVar('SRC_URI') or "").split()
+ fetcher = bb.fetch2.Fetch(src_uri_list, d)
+ # Clone only if network is allowed
+ if network_allowed:
+ fetcher.download()
+ else:
+ # Offline mode without network access
+ bb.note("GENERATE_CVE_EXCLUSIONS_NETWORK=0: Skipping online fetch.
Checking local downloads in DL_DIR...")
+ have_sources = False
+ dl_dir = d.getVar("DL_DIR")
+ srcrev = d.getVar("SRCREV")
+ # Check SRCREV is NOT set to AUTOREV
+ if srcrev.strip() in ("${AUTOREV}", "AUTOINC"):
+ bb.warn("Offline mode but SRCREV is set to AUTOREV/AUTOINC. Cannot
proceed without network access.")
+ return
+ # Loop through the fetcher's expanded URL data
+ for ud in fetcher.expanded_urldata():
+ ud.setup_localpath(d)
+ # Check mirror tarballs first
+ for mirror_fname in ud.mirrortarballs:
+ mirror_path = os.path.join(dl_dir, mirror_fname)
+ if os.path.exists(mirror_path):
+ bb.note(f"Found mirror tarball: {mirror_path}")
+ have_sources = True
+ break
+ # If no mirror, check original download path
+ if not have_sources and ud.localpath and
os.path.exists(ud.localpath):
+ bb.note(f"Found local download: {ud.localpath}")
+ have_sources = True
+ if not have_sources:
+ bb.warn("Offline mode but required source is
missing.\n"f"SRC_URI = {ud.url}")
+ return
+ # Unpack into the standard work directory
+ fetcher.unpack(rootdir)
+ # Remove the folder ${PN} set by unpack
+ subdirs = [d for d in os.listdir(rootdir) if
os.path.isdir(os.path.join(rootdir, d))]
+ if len(subdirs) == 1:
+ srcdir = os.path.join(rootdir, subdirs[0])
+ for f in os.listdir(srcdir):
+ shutil.move(os.path.join(srcdir, f), rootdir)
+ shutil.rmtree(srcdir)
+ bb.note("Vulnerabilities repo unpacked into: %s" % rootdir)
+}
+do_clone_cvelistV5[network] = "${GENERATE_CVE_EXCLUSIONS_NETWORK}"
+do_clone_cvelistV5[nostamp] = "1"
+do_clone_cvelistV5[doc] = "Clone CVE information from the CVE Project:
https://github.com/CVEProject/cvelistV5.git";
+addtask clone_cvelistV5 before do_generate_cve_exclusions
+
+do_generate_cve_exclusions() {
+ generate_cve_exclusions_script=$(find ${COREBASE} -name
"generate-cve-exclusions.py")
+ if [ -z "${generate_cve_exclusions_script}" ]; then
+ bbfatal "generate-cve-exclusions.py not found in ${COREBASE}."
+ fi
+ python3 "${generate_cve_exclusions_script}" \
+ "${GENERATE_CVE_EXCLUSIONS_WORKDIR}/git" \
+ ${LINUX_VERSION} \
+ --output-json >
${GENERATE_CVE_EXCLUSIONS_WORKDIR}/cve-exclusion_${LINUX_VERSION}.json
+}
+do_generate_cve_exclusions[nostamp] = "1"
+do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel
build. (e.g., cve-exclusion_6.12.inc)"
+addtask generate_cve_exclusions after do_clone_cvelistV5 before do_cve_check
+
+python do_cve_check:prepend() {
+ import os
+ import json
+ workdir = d.getVar("GENERATE_CVE_EXCLUSIONS_WORKDIR")
+ kernel_version = d.getVar("LINUX_VERSION")
+ json_input_file = os.path.join(workdir, "cve-exclusion_%s.json" %
kernel_version)
+ if os.path.exists(json_input_file):
+ with open(json_input_file, 'r', encoding='utf-8') as f:
+ cve_data = json.load(f)
+ cve_status_dict = cve_data.get("cve_status", {})
+ count = 0
+ for cve_id, info in cve_status_dict.items():
+ if info.get("active", True):
+ continue
+ d.setVarFlag("CVE_STATUS", cve_id, info.get("message", ""))
+ count += 1
+ bb.note("Loaded %d CVE_STATUS entries from JSON output for kernel %s"
% (count, kernel_version))
+}
\ No newline at end of file
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#229429):
https://lists.openembedded.org/g/openembedded-core/message/229429
Mute This Topic: https://lists.openembedded.org/mt/117285142/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
