@@ -34,6 +34,7 @@ CVE_CHECK_SUMMARY_INDEX_PATH = "${CVE_CHECK_SUMMARY_DIR}/cve-summary-index.txt"
CVE_CHECK_DIR ??= "${DEPLOY_DIR}/cve"
CVE_CHECK_RECIPE_FILE_JSON ?= "${CVE_CHECK_DIR}/${PN}_cve.json"
CVE_CHECK_MANIFEST_JSON ?= "${IMGDEPLOYDIR}/${IMAGE_NAME}.vex.json"
+CVE_CHECK_SDK_MANIFEST_JSON ?= "${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.vex.json"
# Skip CVE Check for packages (PN)
CVE_CHECK_SKIP_RECIPE ?= ""
@@ -298,3 +299,94 @@ def cve_write_data_json(d, cve_data, cve_status):
f.write(write_string)
with open(index_path, "a+") as f:
f.write("%s\n" % fragment_path)
+
+def vex_write_sdk_manifest(d, target_type):
+ """
+ Create VEX/CVE manifest when building an sdk
+ """
+
+ import json
+ from oe.sdk import sdk_list_installed_packages
+ from oe.cve_check import cve_check_merge_jsons
+
+ # Create a list of relevant recipies
+ recipies = set()
+
+ if target_type == "target":
+ pkgdata_dir = d.getVar('PKGDATA_DIR')
+ else:
+ pkgdata_dir = d.getVar('PKGDATA_DIR_SDK')
+
+ for pkg in list(sdk_list_installed_packages(d, target_type == "target")):
+ pkg_info = os.path.join(pkgdata_dir,
+ 'runtime-reverse', pkg)
+ pkg_data = oe.packagedata.read_pkgdatafile(pkg_info)
+ recipies.add(pkg_data["PN"])
+
+ build_dir = d.getVar("B")
+ json_name = d.getVar("TOOLCHAIN_OUTPUTNAME") + '-' + target_type + ".vex.json"
+
+ sdk_name = os.path.join(build_dir, json_name)
+
+ bb.note("Writing sdk %s VEX manifest: %s" % (target_type, sdk_name))
+
+ json_data = {"version":"1", "package": []}
+ text_data = ""
+
+ save_pn = d.getVar("PN")
+
+ for pkg in recipies:
+ # To be able to use the CVE_CHECK_RECIPE_FILE_JSON variable we have to evaluate
+ # it with the different PN names set each time.
+ d.setVar("PN", pkg)
+ pkgfilepath = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
+ if os.path.exists(pkgfilepath):
+ with open(pkgfilepath) as j:
+ data = json.load(j)
+ cve_check_merge_jsons(json_data, data)
+ else:
+ bb.warn("Missing cve file for %s" % pkg)
+
+ d.setVar("PN", save_pn)
+
+ with open(sdk_name, "w") as f:
+ json.dump(json_data, f, indent=2)
+
+python vex_write_sdk_manifest_host () {
+ vex_write_sdk_manifest(d, "host")
+}
+
+python vex_write_sdk_manifest_target () {
+ vex_write_sdk_manifest(d, "target")
+}
+
+POPULATE_SDK_POST_HOST_COMMAND:append:task-populate-sdk = " vex_write_sdk_manifest_host"
+POPULATE_SDK_POST_TARGET_COMMAND:append:task-populate-sdk = " vex_write_sdk_manifest_target"
+
+# Merge the target and host vex files for a single SDK file
+python sdk_create_vex() {
+ import json
+
+ build_dir = d.getVar("B")
+ target_vex_name = d.getVar("TOOLCHAIN_OUTPUTNAME") + '-target' + ".vex.json"
+ host_vex_name = d.getVar("TOOLCHAIN_OUTPUTNAME") + '-host' + ".vex.json"
+
+ target_vex_fname = os.path.join(build_dir, target_vex_name)
+ host_vex_fname = os.path.join(build_dir, host_vex_name)
+
+ json_data = {"version":"1", "package": []}
+
+ # Merge the files together
+ for json_file in [ target_vex_fname, host_vex_fname ]:
+ with open(json_file) as j:
+ data = json.load(j)
+ json_data["package"].extend(data["package"])
+
+ manifest_name = d.getVar("CVE_CHECK_SDK_MANIFEST_JSON")
+ bb.plain("SDK VEX JSON report stored in: %s" % manifest_name)
+
+ with open(manifest_name, "w") as f:
+ json.dump(json_data, f, indent=2)
+}
+
+do_populate_sdk[postfuncs] += "sdk_create_vex"
The existing implementation only worked for image recipes. Enable SDK generation for both target and nativesdk manifests. This is based on the existing implementation, using inspiration from the buildhistory class on how to connect into the SDK generation. The code is handled by generating two vex json files, one for target and one for nativesdk (host) items. As a final step, the two files are merged together into a single vex.json file which is deployed alongside the SDK, and related spdx.json file. Signed-off-by: Mark Hatle <mark.hatle@amd.com> --- meta/classes/vex.bbclass | 92 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)