In case anyone else is affected by this…
1. I tried building inside a Docker container based on Ubuntu 20.04 (and the buildtools removed) and the CVE database was populated properly (and CVE reports generated, etc). 2. It failed during my first attempt, but that was because the buildtools were still present in the workspace. From this, I conclude that using older OS like CentOS with buildtools, though it may be OK for more basic Yocto builds, it has issues when you attempt to make use of the meta-security layer. I believe that the problem is related to the certificate validation tools of buildtool’s host python replacement used to run bitbake, etc. So I suggest that if affected and if you need to continue using the older OS as your build host’s OS, use a Docker container such as that documented at CROPs. Regards, Darcy Darcy Watkins :: Senior Staff Engineer, Firmware SIERRA WIRELESS Direct +1 604 233 7989 :: Fax +1 604 231 1109 :: Main +1 604 231 1100 13811 Wireless Way :: Richmond, BC Canada V6V 3A4 [M4] dwatk...@sierrawireless.com<mailto:dwatk...@sierrawireless.com> :: www.sierrawireless.com<http://www.sierrawireless.com/> From: <yocto@lists.yoctoproject.org> on behalf of "Darcy Watkins via lists.yoctoproject.org" <dwatkins=sierrawireless....@lists.yoctoproject.org> Reply-To: Darcy Watkins <dwatk...@sierrawireless.com> Date: Wednesday, March 17, 2021 at 9:45 AM To: "yocto@lists.yoctoproject.org" <yocto@lists.yoctoproject.org> Subject: [yocto] do_populate_cve_db CERTIFICATE_VERIFY_FAILED Hi, Anyone else encounter this? WARNING: cve-update-db-native-1.0-r0 do_populate_cve_db: Failed to fetch CVE data ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)) I am not sure how to resolve this. After googling on the subject, I found nothing really helpful. Most hits suggest that the certificates are out of date. I tried various suggested ways to resolve it, but nothing works. Furthermore, as I dig into this, it becomes apparent that this could be confused by the different python3 that are on the system. ‘which python3’ points to a python3 that is in the buildtools. So I have a python3 from my CentOS 7 distro, there appears to be one as part of the buildtools (needed when you use CentOS). Then there is python3-native and finally the python3 that is built for the target. I suspect that this may be related to the python3 in the buildtools. Anyone using a newer distro not requiring buildtools may not be affected. I am using CentOS7, Yocto ‘dunfell’ (including the buildtools) and building for an NXP Layerscape target. This particular build adds meta-security and the meta-security-isafw sub-layer (along with prerequisites). Regards, Darcy Darcy Watkins :: Senior Staff Engineer, Firmware SIERRA WIRELESS Direct +1 604 233 7989 :: Fax +1 604 231 1109 :: Main +1 604 231 1100 13811 Wireless Way :: Richmond, BC Canada V6V 3A4 [M4] dwatk...@sierrawireless.com<mailto:dwatk...@sierrawireless.com> :: www.sierrawireless.com<https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sierrawireless.com%2F&data=04%7C01%7Cdwatkins%40sierrawireless.com%7C9c9c9a86d9e24cd66a6708d8e96420c9%7C08059a4c248643dd89e33a747e0dcbe8%7C1%7C0%7C637515963551815984%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=QuruB7%2FVgkwUzBeJUbSd54C2fGIIvSIGcDMvUiTynO0%3D&reserved=0>
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#52802): https://lists.yoctoproject.org/g/yocto/message/52802 Mute This Topic: https://lists.yoctoproject.org/mt/81407902/21656 Group Owner: yocto+ow...@lists.yoctoproject.org Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
