| Message ID | 20260407-fix-lic-sbom-cve-check-v2-2-f69da412fd67@bootlin.com |
|---|---|
| State | Under Review |
| Headers | show |
| Series | sbom-cve-check-update-db: Fix various failures | expand |
Hi, On Tue Apr 7, 2026 at 5:01 PM CEST, Benjamin Robin wrote: > Previously, `UNPACKDIR` was set to `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}`, > which points to the `./databases/` directory and may contain multiple > databases. Since `do_unpack` cleans the `${UNPACKDIR}` directory, > `UNPACKDIR` must only contain a single database. > > To address this, set `UNPACKDIR` to > `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}/${SBOM_CVE_CHECK_DB_NAME}` and > configure `destsuffix` to an empty string. However, it is currently not > possible to set `BB_GIT_DEFAULT_DESTSUFFIX` to an empty string, so > `destsuffix` is configured through the SRC_URI instead. I've tested this the following way, first by unpacking the databases with: SRCREV:pn-sbom-cve-check-update-nvd-native = "ba5e43861ba2ca0f7968597c27c6a412c1bfa8c2" SRCREV:pn-sbom-cve-check-update-cvelist-native = "6740b38b3e0692bb9c96eb226371ae9e1217c1fd" Then created a random file in the nvd database checkout: touch tmp/deploy/sbom-cve-check/databases/nvd-fkie/file.txt Then I updated the sha for cvelist only: SRCREV:pn-sbom-cve-check-update-nvd-native = "ba5e43861ba2ca0f7968597c27c6a412c1bfa8c2" SRCREV:pn-sbom-cve-check-update-cvelist-native = "42e75c927b155335cb1119df9d9b85a58732ad1e" Ran the unpack again, and file.txt is still there. Doing the same without this patch, you'd get: $ ls -l tmp/deploy/sbom-cve-check/databases/nvd-fkie "tmp/deploy/sbom-cve-check/databases/nvd-fkie": No such file or directory (os error 2) This fixes the issue for me too, so feel free to add: Tested-by: Antonin Godard <antonin.godard@bootlin.com> Antonin
diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native.bb index ce204db6c51a..338712216590 100644 --- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native.bb +++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native.bb @@ -3,7 +3,7 @@ LICENSE = "MIT" LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302" HOMEPAGE = "https://github.com/CVEProject/cvelistV5" -SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https" +SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix=" SBOM_CVE_CHECK_DB_NAME = "cvelist" # 2026-03-19_baseline diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-db.inc b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-db.inc index a318e2c40ea9..7ada67363d17 100644 --- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-db.inc +++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-db.inc @@ -15,6 +15,5 @@ deltask do_install deltask do_populate_sysroot # Directly unpack the fetched CVE database to the deploy directory. -UNPACKDIR = "${SBOM_CVE_CHECK_DEPLOY_DB_DIR}" +UNPACKDIR = "${SBOM_CVE_CHECK_DEPLOY_DB_DIR}/${SBOM_CVE_CHECK_DB_NAME}" S = "${UNPACKDIR}" -BB_GIT_DEFAULT_DESTSUFFIX = "${SBOM_CVE_CHECK_DB_NAME}" diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native.bb index 30c7868b2ae7..c868ba09c18d 100644 --- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native.bb +++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native.bb @@ -1,9 +1,9 @@ SUMMARY = "Updates the NVD CVE database" LICENSE = "cve-tou" -LIC_FILES_CHKSUM = "file://${SBOM_CVE_CHECK_DB_NAME}/LICENSES/cve-tou.md;md5=bc5bbf146f01e20ece63d83c8916d8fb" +LIC_FILES_CHKSUM = "file://LICENSES/cve-tou.md;md5=bc5bbf146f01e20ece63d83c8916d8fb" HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds" -SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https" +SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix=" SBOM_CVE_CHECK_DB_NAME = "nvd-fkie" # v2026.03.19-010002
Previously, `UNPACKDIR` was set to `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}`, which points to the `./databases/` directory and may contain multiple databases. Since `do_unpack` cleans the `${UNPACKDIR}` directory, `UNPACKDIR` must only contain a single database. To address this, set `UNPACKDIR` to `${SBOM_CVE_CHECK_DEPLOY_DB_DIR}/${SBOM_CVE_CHECK_DB_NAME}` and configure `destsuffix` to an empty string. However, it is currently not possible to set `BB_GIT_DEFAULT_DESTSUFFIX` to an empty string, so `destsuffix` is configured through the SRC_URI instead. Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com> --- .../sbom-cve-check/sbom-cve-check-update-cvelist-native.bb | 2 +- meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-db.inc | 3 +-- .../sbom-cve-check/sbom-cve-check-update-nvd-native.bb | 4 ++-- 3 files changed, 4 insertions(+), 5 deletions(-)