openembedded-core.git/meta/recipes-devtools/cve-check-tool, branch thud Mirror of openembedded-core cve-check-tool: correctly exported web proxies 2018-02-24T10:31:35+00:00 Konstantin Shemyak konstantin.shemyak@ge.com 2018-02-19T14:35:54+00:00 17db210975c740aff12732c511cf4fb32b507365 The binary 'cve-check-update' downloads the CVE database from the Internet. If the system is behind a web proxy, the download fails, as proxy-related variables are not exported. In turn, 'cve-check-tool' does not connect to the network and correspondingly does not need exported proxies. Exported all proxy-related environment variables to 'cve-check-update' and removed the unneeded export from 'cve-check-tool'. Signed-off-by: Konstantin Shemyak <konstantin.shemyak@ge.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
The binary 'cve-check-update' downloads the CVE database from the Internet.
If the system is behind a web proxy, the download fails, as proxy-related
variables are not exported.
In turn, 'cve-check-tool' does not connect to the network and correspondingly
does not need exported proxies.

Exported all proxy-related environment variables to 'cve-check-update' and
removed the unneeded export from 'cve-check-tool'.

Signed-off-by: Konstantin Shemyak <konstantin.shemyak@ge.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: change BB_NO_NETWORK error to a warning 2017-09-11T16:30:12+00:00 Mikko Rapeli mikko.rapeli@bmw.de 2017-09-06T11:08:16+00:00 acc9994a77972c49a98aabbfd579973885c95f10 It is perfectly fine to execute cve_check tasks against a cached CVE database during a BB_NO_NETWORK build. Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> 
It is perfectly fine to execute cve_check tasks against a cached
CVE database during a BB_NO_NETWORK build.

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: Fix progress bar patch for curl 7.55 2017-08-18T22:51:39+00:00 Jussi Kukkonen jussi.kukkonen@intel.com 2017-08-18T12:38:16+00:00 5548f9c87c6a10cda2baf6f198762380e55f6ae2 CURL_FORMAT_OFF_T does not seem to exist anymore, use CURL_FORMAT_CURL_OFF_T instead. This works with old and new curl. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
CURL_FORMAT_OFF_T does not seem to exist anymore, use
CURL_FORMAT_CURL_OFF_T instead. This works with old and new curl.

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
cve-check-tool: fix crash on exceptions 2017-06-12T14:04:07+00:00 Peter Marko peter.marko@siemens.com 2017-06-07T06:04:31+00:00 06bea09755ebda9bcfa49bf87249f80cb019157e This fixes cve-check-tool crashes on exceptions. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
This fixes cve-check-tool crashes on exceptions.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: backport a patch to make CVE checking work 2017-05-18T13:01:41+00:00 Chen Qi Qi.Chen@windriver.com 2017-05-08T03:12:11+00:00 ee55b5685aaa4be92d6d51f8641a559d4e34ce64 CVE checking in OE didn't work as do_populate_cve_db failed with the following error message. [snip]/downloads/CVE_CHECK/nvdcve-2.0-2002.xml is not consistent Backport a patch to fix this error. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
CVE checking in OE didn't work as do_populate_cve_db failed with the following
error message.

  [snip]/downloads/CVE_CHECK/nvdcve-2.0-2002.xml is not consistent

Backport a patch to fix this error.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: Use CA cert bundle in correct sysroot 2017-02-15T17:29:42+00:00 Jussi Kukkonen jussi.kukkonen@intel.com 2017-02-09T19:38:33+00:00 73bd11d5190a072064128cc13b4537154d07b129 Native libcurl looks for CA certs in the wrong place by default. * Add patch that allows overriding the default CA certificate location. Patch is originally from meta-security-isafw. * Use the new --cacert to set the correct CA bundle path Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Native libcurl looks for CA certs in the wrong place by
default.
* Add patch that allows overriding the default CA certificate
  location. Patch is originally from meta-security-isafw.
* Use the new --cacert to set the correct CA bundle path

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: Fixes for recipe sysroots 2017-02-15T17:29:42+00:00 Jussi Kukkonen jussi.kukkonen@intel.com 2017-02-09T19:38:32+00:00 2da6b01893d0afe8750bd0b12a8d55aafa82f58c * Use --enable-relative-plugins so cve-check-tool looks for loadable modules relative to binary location instead of hard-coding a wrong sysroot location * do_populate_cve_db() assumes that the binary cve-check-update is in the sysroot. Ensure that this is true by adding a task dependency Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
* Use --enable-relative-plugins so cve-check-tool looks for
  loadable modules relative to binary location instead of
  hard-coding a wrong sysroot location
* do_populate_cve_db() assumes that the binary cve-check-update is in
  the sysroot. Ensure that this is true by adding a task dependency

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: fix upstream version check 2016-10-28T10:27:33+00:00 Alexander Kanavin alexander.kanavin@linux.intel.com 2016-10-18T12:11:49+00:00 4f96180ef525ad2b2cad935bd7253a5a0a079ff4 Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
cve-check-tool: report progress when downloading CVE database 2016-09-28T14:02:14+00:00 André Draszik git@andred.net 2016-09-28T12:05:45+00:00 145a29ca99d9fec5eff97d77c8cff6356fe88ba5 We add a patch to report the progress, and at the same time inform bitbake that progress can be extracted via the simple 'percent' progress handler. Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
We add a patch to report the progress, and at the same time
inform bitbake that progress can be extracted via the simple
'percent' progress handler.

Signed-off-by: André Draszik <git@andred.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
cve-check-tool: convert do_populate_cve_db() from python to sh 2016-09-28T14:02:14+00:00 André Draszik git@andred.net 2016-09-28T12:05:44+00:00 1bf0137ac84e5d324fd84dadfa962fbc166b5d4b This will allow us to easily incorporate progress support via bb.process.run() Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
This will allow us to easily incorporate progress support
via bb.process.run()

Signed-off-by: André Draszik <git@andred.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>