mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-11-01 20:52:36 -10:00
345c8ffc96
If a vulnerability is present in multiple components and only one of
them has a patch that addresses that vulnerability, all components will
currently have that vulnerability marked as `resolved_with_pedigree`.
Right now, this issue does not affect any packages, but in the future it
might affect packages that provide multiple version options (e.g.
gnupg and gnupg2).
There is a small chance this happens in a real-world use case, but it
may occur in the context of maintenance when running
`make show-info-all`.
This commit changes how vulnerabilities fixed by a patch are stored.
Instead of placing all vulnerabilities into a single set, it now keeps an
index of the component for which the patch has been applied.
When generating the vulnerability list, the component reference is
checked instead of only the vulnerability ID. If a vulnerability ID has
multiple states for different references, multiple vulnerability
entries are created with distinct analyses.
Consider the hypothetical case where gnupg ignores a vulnerability
because it was introduced in a later version, while gnupg2 has patched
that vulnerability. This would result in the following JSON:
```json
[
{
"id": "CVE-1234-1234",
"analysis": {
"state": "in_triage",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg"}
]
},
{
"id": "CVE-1234-1234",
"analysis": {
"state": "resolved_with_pedigree",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg2"}
]
}
]
```
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
- update the VULN_WITH_PEDIGREE comment to match the code
- use set() as default instead of {}]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This directory contains various useful scripts and tools for working
with Buildroot. You need not add this directory in your PATH to use
any of those tools, but you may do so if you want.
brmake
a script that can be run instead of make, that prepends the date in
front of each line, redirects all of the build output to a file
("'br.log' in the current directory), and just outputs the Buildroot
messages (those lines starting with >>>) on stdout.
Do not run this script for interactive configuration (e.g. menuconfig)
or on an unconfigured directory. The output is redirected so you will see
nothing.
check-package
a script that checks the coding style across the buildroot tree. It
checks package's Config.in and .mk files, runs shellcheck for all shell
scripts, flake8 for python files, checks for typos, etc.
It checks the .checkpackageignore file if errors should be ignored and
errors if there's a file listed that doesn't produce an error.
docker-run
a script that runs a command (like make check-package) inside the
buildroot CI docker container; pass no command to get an interactive
shell.
genrandconfig
a script that generates a random configuration, used by the autobuilders
(http://autobuild.buildroot.org). It selects a random toolchain from
support/config-fragments/autobuild and randomly selects packages to build.
get-developers
a script to return the list of people interested in a specific part
of Buildroot, so they can be Cc:ed on a mail. Accepts a patch as
input, a package name or and architecture name.
scancpan
a script to create a Buildroot package by scanning a CPAN module
description.
scanpypi
a script to create a Buildroot package by scanning a PyPI package
description.
size-stats-compare
a script to compare the rootfs size between two different Buildroot
configurations. This can be used to identify the size impact of
a specific option, of a set of specific options, or of an update
to a newer Buildroot version...
test-pkg
a script that tests a specific package against a set of various
toolchains, with the goal to detect toolchain-related dependencies
(wchar, threads...)