[2/4] generate-cve-exclusions: Add a .bbclass

Add a .bbclass to generate-cve-exclusions to use this script at every
run.
This class needs to be inherit by the linux kernel recipe.

This class contains several methods:

*do_clone_cvelistV5: Clone the cvelistV5 repo in
${WORKDIR}/cvelistV5/git

(e.g. bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/
linux-yocto/6.18.1+git/cvelistV5/git)

*do_generate_cve_exclusions: Use the script generate-cve-exclusions.py.
It uses the new "--output-json" argument to generate a JSON file as an
output stored in ${WORKDIR}/cvelistV5//cve-exclusion_${LINUX_VERSION}.json

*do_cve_check:prepend: Parse the previously generated JSON file to set
the variable CVE_STATUS corretly
---
 meta/classes/generate-cve-exclusions.bbclass | 67 ++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 meta/classes/generate-cve-exclusions.bbclass

I can't tell, if this runs on every bitbake/compilation of the kernel, then
this is a hard NACK.

Make a task for it, or just add instructions on how to generate these, but
it cannot be in the standard build set of tasks.

Bruce

On Tue, Jan 6, 2026 at 1:28 PM vboudevin via lists.openembedded.org
<valentin.boudevin=gmail.com@lists.openembedded.org> wrote:

> Add a .bbclass to generate-cve-exclusions to use this script at every
> run.
> This class needs to be inherit by the linux kernel recipe.
>
> This class contains several methods:
>
> *do_clone_cvelistV5: Clone the cvelistV5 repo in
> ${WORKDIR}/cvelistV5/git
>
> (e.g. bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/
> linux-yocto/6.18.1+git/cvelistV5/git)
>
> *do_generate_cve_exclusions: Use the script generate-cve-exclusions.py.
> It uses the new "--output-json" argument to generate a JSON file as an
> output stored in ${WORKDIR}/cvelistV5//cve-exclusion_${LINUX_VERSION}.json
>
> *do_cve_check:prepend: Parse the previously generated JSON file to set
> the variable CVE_STATUS corretly
> ---
>  meta/classes/generate-cve-exclusions.bbclass | 67 ++++++++++++++++++++
>  1 file changed, 67 insertions(+)
>  create mode 100644 meta/classes/generate-cve-exclusions.bbclass
>
> diff --git a/meta/classes/generate-cve-exclusions.bbclass
> b/meta/classes/generate-cve-exclusions.bbclass
> new file mode 100644
> index 0000000000..3e34ba563d
> --- /dev/null
> +++ b/meta/classes/generate-cve-exclusions.bbclass
> @@ -0,0 +1,67 @@
> +CVE_EXCLUSIONS_WORKDIR ?= "${WORKDIR}/cvelistV5"
> +CVELISTV5_PATH ?= "${CVE_EXCLUSIONS_WORKDIR}/git"
> +
> +python do_clone_cvelistV5() {
> +    import subprocess
> +    import shutil, os
> +    rootdir = d.getVar("CVELISTV5_PATH")
> +    d.setVar("SRC_URI", "git://
> github.com/CVEProject/cvelistV5.git;branch=main;protocol=https")
> +    d.setVar("SRCREV", "${AUTOREV}")
> +    src_uri = (d.getVar('SRC_URI') or "").split()
> +    # Fetch the kernel vulnerabilities sources
> +    fetcher = bb.fetch2.Fetch(src_uri, d)
> +    fetcher.download()
> +    # Unpack into the standard work directory
> +    fetcher.unpack(rootdir)
> +    # Remove the folder ${PN} set by unpack
> +    subdirs = [d for d in os.listdir(rootdir) if
> os.path.isdir(os.path.join(rootdir, d))]
> +    if len(subdirs) == 1:
> +        srcdir = os.path.join(rootdir, subdirs[0])
> +        for f in os.listdir(srcdir):
> +            shutil.move(os.path.join(srcdir, f), rootdir)
> +        shutil.rmtree(srcdir)
> +    bb.note("Vulnerabilities repo unpacked into: %s" % rootdir)
> +}
> +do_clone_cvelistV5[network] = "1"
> +do_clone_cvelistV5[nostamp] = "1"
> +do_clone_cvelistV5[doc] = "Clone CVE information from the CVE Project:
> https://github.com/CVEProject/cvelistV5.git"
> +addtask clone_cvelistV5 after do_fetch before do_generate_cve_exclusions
> +
> +do_generate_cve_exclusions() {
> +    generate_cve_exclusions_script=$(find ${COREBASE} -name
> "generate-cve-exclusions.py")
> +    if [ -z "${generate_cve_exclusions_script}" ]; then
> +        bbfatal "generate-cve-exclusions.py not found in ${COREBASE}."
> +    fi
> +    python3 "${generate_cve_exclusions_script}" \
> +        ${CVELISTV5_PATH} \
> +        ${LINUX_VERSION} \
> +        --output-json >
> ${CVE_EXCLUSIONS_WORKDIR}/cve-exclusion_${LINUX_VERSION}.json
> +}
> +do_generate_cve_exclusions[nostamp] = "1"
> +do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel
> build. (e.g., cve-exclusion_6.12.inc)"
> +addtask generate_cve_exclusions after do_clone_cvelistV5 before
> do_cve_check
> +
> +python do_cve_check:prepend() {
> +    import os
> +    import json
> +
> +    workdir = d.getVar("CVE_EXCLUSIONS_WORKDIR")
> +    kernel_version = d.getVar("LINUX_VERSION")
> +    json_input_file = os.path.join(workdir, "cve-exclusion_%s.json" %
> kernel_version)
> +
> +    # Parse JSON
> +    with open(json_input_file, 'r', encoding='utf-8') as f:
> +        cve_data = json.load(f)
> +
> +    cve_status_dict = cve_data.get("cve_status", {})
> +
> +    if os.path.exists(json_input_file):
> +        count = 0
> +        for cve_id, info in cve_status_dict.items():
> +            if info.get("active", True):
> +                # Skip active CVEs
> +                continue
> +            d.setVarFlag("CVE_STATUS", cve_id, info.get("message", ""))
> +            count += 1
> +    bb.note("Loaded %d CVE_STATUS entries from JSON output for kernel %s"
> % (count, kernel_version))
> +}
> \ No newline at end of file
> --
> 2.43.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#228910):
> https://lists.openembedded.org/g/openembedded-core/message/228910
> Mute This Topic: https://lists.openembedded.org/mt/117110144/1050810
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

Thanks for your feedback.

Then, I will modify it to be an independent task which can be run with "bitbake linux-yocto -c generate_cve_exclusions".
It will remove the mandatory aspect of this task in the workflow.