mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-09 17:03:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/pkg-generic.mk: replicate IGNORE_CVES to host packages

Browse Source 
For host packages, this commit adds the same `ignore_cves` list as their
target counterpart and make it available from the `show-info` output.

When generating a CycloneDX SBOM with `make show-info-all |
utils/generate-cyclonedx` and running an analysis over it with
`support/script/cve-check`, multiple vulnerabilities
entries would be created with different analysis for packages that have
both a host and target variant that include IGNORE_CVES entries.

This is the case for the grub2 package that include ignored
vulnerabilities that patch both the target and host package but aren't
declared as ignored for the host package. This resulted in
vulnerabilities marked as 'exploitable' for the host variant while it
is patched.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Thomas Perale
2026-05-29 17:06:31 +02:00
committed by Thomas Petazzoni
parent d4ff747a2b
commit 7a5817137b
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
package/pkg-generic.mk
View File

@@ -745,6 +745,13 @@ ifeq ($$($(2)_CPE_ID_VALID),YES)
$(2)_CPE_ID = $$($(2)_CPE_ID_PREFIX):$$($(2)_CPE_ID_VENDOR):$$($(2)_CPE_ID_PRODUCT):$$($(2)_CPE_ID_VERSION):$$($(2)_CPE_ID_UPDATE):*:*:*:*:*:*
endif # ifeq ($$($(2)_CPE_ID_VALID),YES)
# replicate the target '_IGNORE_CVES' to the host variant
ifndef $(2)_IGNORE_CVES
ifdef $(3)_IGNORE_CVES
$(2)_IGNORE_CVES = $$($(3)_IGNORE_CVES)
endif
endif
# When a target package is a toolchain dependency set this variable to
# 'NO' so the 'toolchain' dependency is not added to prevent a circular
# dependency.