diff mbox series

[RFC,yocto-autobuilder-helper] Port CVE scanning from cve-check to sbom-cve-check

Message ID 20260407210710.2386697-1-ross.burton@arm.com
State New
Headers show
Series [RFC,yocto-autobuilder-helper] Port CVE scanning from cve-check to sbom-cve-check | expand

Commit Message

Ross Burton April 7, 2026, 9:07 p.m. UTC 
Use the new sbom-cve-check-recipe class to scan meta-world-recipe-sbom,
instead of using cve-check.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 config.json          | 7 ++-----
 scripts/run-cvecheck | 5 +++--
 2 files changed, 5 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/config.json b/config.json
index 5e5071e6..de741132 100644
--- a/config.json
+++ b/config.json
@@ -1366,12 +1366,9 @@ 
         "metrics" : {
             "NEEDREPOS" : ["bitbake", "meta-openembedded"],
             "extravars" : [
-                "INHERIT += 'cve-check'",
+                "OE_FRAGMENTS += 'core/yocto/sbom-cve-check'",
+                "INHERIT += 'sbom-cve-check-recipe'",
                 "BB_DISKMON_DIRS = ''",
-                "CVE_CHECK_FORMAT_JSON = '1'",
-                "CVE_CHECK_SHOW_WARNINGS = '0'",
-                "CVE_DB_UPDATE_INTERVAL = '21600'",
-                "CVE_DB_INCR_UPDATE_AGE_THRES = '21600'",
                 "LICENSE_FLAGS_ACCEPTED = 'commercial'",
                 "BB_SERVER_TIMEOUT = '0'"
             ],
diff --git a/scripts/run-cvecheck b/scripts/run-cvecheck
index 75754fba..43bf37f9 100755
--- a/scripts/run-cvecheck
+++ b/scripts/run-cvecheck
@@ -74,15 +74,16 @@  fi
 set +u
 source ./init-build-env build
 set -u
-bitbake world --runall cve_check -R conf/distro/include/cve-extra-exclusions.inc
 
+bitbake meta-world-recipe-sbom -R conf/distro/include/cve-extra-exclusions.inc -c sbom_cve_check_recipe
 # Do another pull to make sure we're as up to date as possible.  This is
 # preferable to committing and rebasing before pushing as it would be better to
 # waste some time repeating work than commit potentially corrupted files from a
 # git merge gone wrong.
 git -C $METRICSDIR pull
 
-CVE_REPORT=tmp/log/cve/cve-summary.json
+# Use the latest report, in case the build tree has more than one
+CVE_REPORT=$(ls -t tmp/deploy/images/*/world-recipe-sbom.sbom-cve-check.yocto.json | head -n1)
 
 if [ -e $CVE_REPORT ]; then
     git -C $METRICSDIR rm --ignore-unmatch cve-check/$BRANCH/*.json