mbox series

[RFC,0/2] sbom-cve-check: Improve class implementation and dependencies

Message ID 20260309-add-sbom-cve-check-p2-v1-0-72a0771e1f12@bootlin.com
Headers show
Series sbom-cve-check: Improve class implementation and dependencies | expand

Message

Benjamin Robin March 9, 2026, 11:56 a.m. UTC 
This series is an RFC and a follow-up to patch 6/6 ("Add class for
post-build CVE analysis"), which was previously discussed [1].
I have prepared two RFC series, this one and another, each exploring
different approaches to handling the download of CVE databases.

I explored using BitBake's internal fetcher instead of direct Git calls
for fetching CVE databases. However, I encountered two major issues:

- No proper shallow clone support: I wanted to clone the repository
  without downloading the entire history (which is very large). While
  `BB_GIT_SHALLOW` exists, it creates multiple tarballs in the download
  directory, which is inefficient for updates.

- Performance overhead for CVE databases deployment: The recipes
  downloading CVE databases must copy them to the sysroot or to the
  deploy directory. This requires copying the extracted databases
  multiple times, even with hard links, which is slow due to the
  combined size (~6 GB, ~672,000 small files).

Additionally, there's no built-in way to control the interval between
CVE database fetches.

Given these limitations, I retained the current custom `do_fetch`
implementation for now.

The primary goal of this series is to ensure CVE analysis runs only when
the original SBOM changes or when the CVE databases are updated.

Upon revisiting the class and its associated recipes, I identified
several areas for improvement, which were fixed in the first commit.
This series also includes a second commit making the VEX class optional
rather than mandatory.

[1] https://lore.kernel.org/all/20260226-add-sbom-cve-check-v3-0-2e60423f4d35@bootlin.com/

Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
---
Benjamin Robin (2):
      sbom-cve-check: Fix task dependencies to run only when DB changes
      sbom-cve-check: VEX class is no longer mandatory

 meta/classes-recipe/sbom-cve-check.bbclass         | 63 ++++++++++++++--------
 meta/recipes-core/meta/sbom-cve-check-config.inc   |  4 ++
 .../meta/sbom-cve-check-update-cvelist-native.bb   |  5 +-
 .../meta/sbom-cve-check-update-db.inc}             | 37 ++++++++-----
 .../meta/sbom-cve-check-update-nvd-native.bb       |  5 +-
 5 files changed, 75 insertions(+), 39 deletions(-)
---
base-commit: ac13c78c0b1a73aa3f21a506a8709ecebfd98faf
change-id: 20260307-add-sbom-cve-check-p2-3d169032fb63

Best regards,