summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoss Burton <ross@burtonini.com>2020-11-19 10:38:09 +0000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-11-24 10:27:45 +0000
commit0be2aedfd3fba09d187f5de31925747291ea5cd2 (patch)
treed7268c9f645bad7c07251c2551d91891137c3b88
parent913ed9a6b137e77a023a78273f633b15c7e9fd4f (diff)
downloadpoky-0be2aedfd3fba09d187f5de31925747291ea5cd2.tar.gz
poky-0be2aedfd3fba09d187f5de31925747291ea5cd2.tar.bz2
poky-0be2aedfd3fba09d187f5de31925747291ea5cd2.zip
cve-check: show real PN/PV
The output currently shows the remapped product and version fields, which may not be the actual recipe name/version. As this report is about recipes, use the real values. (From OE-Core rev: 18827d7f40db4a4f92680bd59ca655cca373ad65) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/classes/cve-check.bbclass9
1 files changed, 6 insertions, 3 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 25cefda92e..d843e7c4ac 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -208,6 +208,9 @@ def check_cves(d, patched_cves):
"""
from distutils.version import LooseVersion
+ pn = d.getVar("PN")
+ real_pv = d.getVar("PV")
+
cves_unpatched = []
# CVE_PRODUCT can contain more than one product (eg. curl/libcurl)
products = d.getVar("CVE_PRODUCT").split()
@@ -217,7 +220,7 @@ def check_cves(d, patched_cves):
pv = d.getVar("CVE_VERSION").split("+git")[0]
# If the recipe has been whitlisted we return empty lists
- if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split():
+ if pn in d.getVar("CVE_CHECK_PN_WHITELIST").split():
bb.note("Recipe has been whitelisted, skipping check")
return ([], [], [])
@@ -286,12 +289,12 @@ def check_cves(d, patched_cves):
vulnerable = vulnerable_start or vulnerable_end
if vulnerable:
- bb.note("%s-%s is vulnerable to %s" % (product, pv, cve))
+ bb.note("%s-%s is vulnerable to %s" % (pn, real_pv, cve))
cves_unpatched.append(cve)
break
if not vulnerable:
- bb.note("%s-%s is not vulnerable to %s" % (product, pv, cve))
+ bb.note("%s-%s is not vulnerable to %s" % (pn, real_pv, cve))
# TODO: not patched but not vulnerable
patched_cves.add(cve)