mbox series

[scarthgap,0/3] meta: Backport rejected CVEs and SPDX3 fixes

Message ID 20260303-backport-fixes-scarthgap-v1-0-2dc803f921a9@bootlin.com
Headers show
Series meta: Backport rejected CVEs and SPDX3 fixes | expand

Message

Benjamin Robin (Schneider Electric) March 3, 2026, 4:46 p.m. UTC 
This series backports three patches from `master` to `Scarthgap`.

Removed references to rejected CVEs:
 - Removed references to `CVE-2025-62813` and `CVE-2021-3502` in patch
   files, as these CVEs have been rejected.
 - This change prevents rejected CVE references from appearing in the
   generated SBOM.

Fixed kernel `CONFIG_` generation in SPDX3:
 - Backported a fix for the generation of kernel `CONFIG_` values in
   SPDX3 output.
 - This is a important fix, as the generated SBOM file might otherwise
   randomly omit kernel `CONFIG_` values.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Benjamin Robin (Schneider Electric) (3):
      avahi: Remove a reference to the rejected CVE-2021-36217
      lz4: Remove a reference to the rejected CVE-2025-62813
      meta: fix generation of kernel CONFIG_ in SPDX3

 meta/classes-recipe/kernel.bbclass                 | 27 ++++++++++++----------
 meta/lib/oeqa/selftest/cases/spdx.py               |  2 +-
 .../avahi/files/local-ping.patch                   |  1 -
 ...5-62813.patch => fix-null-error-handling.patch} |  1 -
 meta/recipes-support/lz4/lz4_1.9.4.bb              |  2 +-
 5 files changed, 17 insertions(+), 16 deletions(-)
---
base-commit: a9a785d7fa0cfe2a9087dbcde0ef9f0d2a441375
change-id: 20260303-backport-fixes-scarthgap-c8d4140edfa0

Best regards,