mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-30 22:11:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

support/scripts/cve-check: fix typos and grammar

Browse Source 
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8b740cee42)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-12-07 10:28:19 +01:00
parent af13e95e15
commit 1d5f7045d6
1 changed files with 16 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
support/scripts/cve-check
View File

@@ -4,7 +4,7 @@
# Enriches the input CycloneDX SBOM with vulnerability information from the NVD # Enriches the input CycloneDX SBOM with vulnerability information from the NVD
# database. # database.
# #
# The nvd database is cloned using a mirror of it and the content is compared # The NVD database is cloned using a mirror of it and the content is compared
# locally. # locally.
# #
# Example usage: # Example usage:
@@ -121,7 +121,7 @@ def nvd_cve_references_to_cdx(references):
def nvd_cve_to_cdx_vulnerability(nvd_cve): def nvd_cve_to_cdx_vulnerability(nvd_cve):
""" """
Turns the CVE object fetched from the NVD API into a CycloneDX Turns the CVE object fetched from the NVD API into a CycloneDX
vulnerability that fit the spec (see [1]). vulnerability that fits the spec (see [1]).
[1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities [1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities
""" """
@@ -153,19 +153,19 @@ def nvd_cve_to_cdx_vulnerability(nvd_cve):
return vulnerability return vulnerability
def vuln_append_or_update_affects_if_exist(vulnerabilities, vulnerability): def vuln_append_or_update_affects_if_exists(vulnerabilities, vulnerability):
""" """
Append 'vulnerability' passed as argument to the 'vulnerabilities' argument Append 'vulnerability' passed as argument to the 'vulnerabilities' argument
if an entry with the same 'id' don't exist yet. if an entry with the same 'id' doesn't exist yet.
If an entry already exist the input reference is added to the 'affects' If the vulnerability already exists, the input reference is added to the
list of the existing vulnerability. 'affects' list of the existing entry.
Args: Args:
vulnerabilities (list): The vulnerabilities array reference retrieved vulnerabilities (list): The vulnerabilities array reference retrieved
from the input CycloneDX SBOM from the input CycloneDX SBOM
vulnerability (dict): Vulnerability to add to the 'vulnerabilities' list. vulnerability (dict): Vulnerability to add to the 'vulnerabilities' list.
""" """
# Search if a vulnerability with the same identifier already exist in the # Search if a vulnerability with the same identifier already exists in the
# SBOM vulnerability list. # SBOM vulnerability list.
matching_vuln = next( matching_vuln = next(
(vuln for vuln in vulnerabilities if vuln.get("id") == vulnerability["id"]), (vuln for vuln in vulnerabilities if vuln.get("id") == vulnerability["id"]),
@@ -173,6 +173,7 @@ def vuln_append_or_update_affects_if_exist(vulnerabilities, vulnerability):
) )
# bom-ref to the component is passed to the affects of the vulnerability # bom-ref to the component is passed to the affects of the vulnerability
# passed as argument
bom_ref = next((a["ref"] for a in vulnerability.get("affects", [])), None) bom_ref = next((a["ref"] for a in vulnerability.get("affects", [])), None)
if matching_vuln is not None: if matching_vuln is not None:
@@ -181,7 +182,7 @@ def vuln_append_or_update_affects_if_exist(vulnerabilities, vulnerability):
del vulnerability["affects"] del vulnerability["affects"]
if matching_vuln.get("analysis") is not None and "analysis" in vulnerability: if matching_vuln.get("analysis") is not None and "analysis" in vulnerability:
# We don't update vulnerability that already have an # We don't update vulnerabilities that already have an
# 'analysis'. # 'analysis'.
# Buildroot ignored vulnerabilities will already have # Buildroot ignored vulnerabilities will already have
# an analysis and need to remain as such. # an analysis and need to remain as such.
@@ -228,13 +229,13 @@ def check_package_cve_affects(cve: cvecheck.CVE, cpe_product_pkgs, sbom, opt: Op
"ref": comp["bom-ref"] "ref": comp["bom-ref"]
}] }]
vuln_append_or_update_affects_if_exist(vulnerabilities, vulnerability) vuln_append_or_update_affects_if_exists(vulnerabilities, vulnerability)
def check_package_cves(nvd_path: Path, sbom, opt: Options): def check_package_cves(nvd_path: Path, sbom, opt: Options):
""" """
Iterate over every entries of the NDV API mirror. Each vulnerability is Iterate over every entry of the NVD API mirror. Each vulnerability is
compared to the set of component passed as argument in the 'sbom'. compared to the set of components passed as argument in the 'sbom'.
The vulnerabilities set of that 'sbom' argument is enriched with analysis The vulnerabilities set of that 'sbom' argument is enriched with analysis
of vulnerabilities that match that set of components. of vulnerabilities that match that set of components.
@@ -257,7 +258,7 @@ def check_package_cves(nvd_path: Path, sbom, opt: Options):
def enrich_vulnerabilities(nvd_path: Path, sbom): def enrich_vulnerabilities(nvd_path: Path, sbom):
""" """
Iterate over the vulnerabilities present in the 'sbom' passed as arguments Iterate over the vulnerabilities present in the 'sbom' passed as arguments
and enrich the vulnerability with content from the NDV API mirror. and enrich the vulnerability with content from the NVD API mirror.
Args: Args:
nvd_path (Path): Path of the mirror of the NVD API. nvd_path (Path): Path of the mirror of the NVD API.
@@ -274,7 +275,7 @@ def enrich_vulnerabilities(nvd_path: Path, sbom):
vulnerability = nvd_cve_to_cdx_vulnerability(cve.nvd_cve) vulnerability = nvd_cve_to_cdx_vulnerability(cve.nvd_cve)
vuln_append_or_update_affects_if_exist(vulnerabilities, vulnerability) vuln_append_or_update_affects_if_exists(vulnerabilities, vulnerability)
def main(): def main():
@@ -288,8 +289,8 @@ def main():
help='Path to the local NVD database', help='Path to the local NVD database',
type=lambda p: Path(p).expanduser().resolve()) type=lambda p: Path(p).expanduser().resolve())
parser.add_argument("--enrich-only", default=False, action='store_true', parser.add_argument("--enrich-only", default=False, action='store_true',
help="Only update metadata to the vulnerability currently present " + help="Only update metadata for the vulnerabilities currently present " +
"on the input CycloneDX SBOM. Don't do an analysis.") "in the input CycloneDX SBOM. Don't do an analysis.")
parser.add_argument("--include-resolved", default=False, action='store_true', parser.add_argument("--include-resolved", default=False, action='store_true',
help="Add vulnerabilities already 'resolved' that don't affect a " + help="Add vulnerabilities already 'resolved' that don't affect a " +
"component to the output CycloneDX vulnerabilities analysis.") "component to the output CycloneDX vulnerabilities analysis.")