| Message ID | 20260923-fix-cvecheck-warning-fdunfell-v1-1-bd0c0b400f84@bootlin.com |
|---|---|
| State | New |
| Headers | show |
| Series | [yocto-autobuilder-helper,dunfell] config.json: fix cvecheck iputils warning | expand |
diff --git a/config.json b/config.json index 94250e9..69674e9 100644 --- a/config.json +++ b/config.json @@ -853,6 +853,9 @@ }, "step2" : { "shortname" : "CVE checks for meta", + "extravars" : [ + "PV:pn-iputils = '20190709'" + ], "EXTRACMDS" : ["${SCRIPTSDIR}/run-cvecheck --metrics ../yocto-metrics --branch ${HELPERBRANCHNAME} --results ${HELPERRESULTSDIR}/../../patchmetrics --push"] }, "step3" : {
On Yocto Dunfell, an EOL version of Yocto, we consistently have the following warning showed during the metrics job: WARNING: iputils-s20190709-r0 do_cve_check: iputils: Failed to compare s20190709 < 20250602 for CVE-2025-47268 This is because upstream stopped adding the leading "s" to their version. Since we can't patch Yocto dunfell anymore, as a workaround set the version of iputils so that the comparison passes. This makes the cvecheck class show the following warning instead, which is expected: WARNING: iputils-20190709-r0 do_cve_check: Found unpatched CVE (CVE-2025-47268), for more information check /build/tmp/work/aarch64-poky-linux/iputils/20190709-r0/temp/cve.log Which isn't shown on the Autobuilder thanks to CVE_CHECK_SHOW_WARNINGS = '0'. Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> --- Test build (not pushed to metrics repo): https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4111 --- config.json | 3 +++ 1 file changed, 3 insertions(+) --- base-commit: 59108a784c3d37f96f408d18993a3039a2e017bb change-id: 20260923-fix-cvecheck-warning-fdunfell-409f249b5311