new file mode 100644
@@ -0,0 +1,67 @@
+CVE_EXCLUSIONS_WORKDIR ?= "${WORKDIR}/cvelistV5"
+CVELISTV5_PATH ?= "${CVE_EXCLUSIONS_WORKDIR}/git"
+
+python do_clone_cvelistV5() {
+ import subprocess
+ import shutil, os
+ rootdir = d.getVar("CVELISTV5_PATH")
+ d.setVar("SRC_URI", "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https")
+ d.setVar("SRCREV", "${AUTOREV}")
+ src_uri = (d.getVar('SRC_URI') or "").split()
+ # Fetch the kernel vulnerabilities sources
+ fetcher = bb.fetch2.Fetch(src_uri, d)
+ fetcher.download()
+ # Unpack into the standard work directory
+ fetcher.unpack(rootdir)
+ # Remove the folder ${PN} set by unpack
+ subdirs = [d for d in os.listdir(rootdir) if os.path.isdir(os.path.join(rootdir, d))]
+ if len(subdirs) == 1:
+ srcdir = os.path.join(rootdir, subdirs[0])
+ for f in os.listdir(srcdir):
+ shutil.move(os.path.join(srcdir, f), rootdir)
+ shutil.rmtree(srcdir)
+ bb.note("Vulnerabilities repo unpacked into: %s" % rootdir)
+}
+do_clone_cvelistV5[network] = "1"
+do_clone_cvelistV5[nostamp] = "1"
+do_clone_cvelistV5[doc] = "Clone CVE information from the CVE Project: https://github.com/CVEProject/cvelistV5.git"
+addtask clone_cvelistV5 before do_generate_cve_exclusions
+
+do_generate_cve_exclusions() {
+ generate_cve_exclusions_script=$(find ${COREBASE} -name "generate-cve-exclusions.py")
+ if [ -z "${generate_cve_exclusions_script}" ]; then
+ bbfatal "generate-cve-exclusions.py not found in ${COREBASE}."
+ fi
+ python3 "${generate_cve_exclusions_script}" \
+ ${CVELISTV5_PATH} \
+ ${LINUX_VERSION} \
+ --output-json > ${CVE_EXCLUSIONS_WORKDIR}/cve-exclusion_${LINUX_VERSION}.json
+}
+do_generate_cve_exclusions[nostamp] = "1"
+do_generate_cve_exclusions[doc] = "Generate CVE exclusions for the kernel build. (e.g., cve-exclusion_6.12.inc)"
+addtask generate_cve_exclusions after do_clone_cvelistV5
+
+python do_cve_check:prepend() {
+ import os
+ import json
+
+ workdir = d.getVar("CVE_EXCLUSIONS_WORKDIR")
+ kernel_version = d.getVar("LINUX_VERSION")
+ json_input_file = os.path.join(workdir, "cve-exclusion_%s.json" % kernel_version)
+
+ if os.path.exists(json_input_file):
+ with open(json_input_file, 'r', encoding='utf-8') as f:
+ cve_data = json.load(f)
+ cve_status_dict = cve_data.get("cve_status", {})
+ count = 0
+ for cve_id, info in cve_status_dict.items():
+ if info.get("active", True):
+ # Skip active CVEs
+ continue
+ d.setVarFlag("CVE_STATUS", cve_id, info.get("message", ""))
+ count += 1
+
+ bb.note("Loaded %d CVE_STATUS entries from JSON output for kernel %s" % (count, kernel_version))
+ else:
+ bb.warn("CVE exclusion JSON not found: %s. Skipping CVE_STATUS updates" % json_input_file)
+}
\ No newline at end of file
Add a .bbclass to generate-cve-exclusions to use this script at every run. Two steps for testing: 1) Inherit this class in the kernel recipe with "inherit generate-cve-exclusions.bbclass" 2) Use the following command to generate a cvelistV5 entry with a JSON file in in ${WORKDIR}/cvelistV5/ : "bitbake linux-yocto -c generate-cve-exclusions" The JSON file can then be parsed in the following run by cve-check. This class contains several methods: *do_clone_cvelistV5: Clone the cvelistV5 repo in ${WORKDIR}/cvelistV5/git (e.g. bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/ linux-yocto/6.18.1+git/cvelistV5/git) *do_generate_cve_exclusions: Use the script generate-cve-exclusions.py. It uses the new "--output-json" argument to generate a JSON file as an output stored in ${WORKDIR}/cvelistV5//cve-exclusion_${LINUX_VERSION}.json *do_cve_check:prepend: Parse the previously generated JSON file to set the variable CVE_STATUS corretly --- meta/classes/generate-cve-exclusions.bbclass | 67 ++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 meta/classes/generate-cve-exclusions.bbclass