From: Mariano Lopez <mariano.lopez@linux.intel.com>
To: Mikko.Rapeli@bmw.de
Cc: openembedded-core@lists.openembedded.org
Subject: Re: [PATCH 0/3] Add initial capability to check CVEs for recipes
Date: Fri, 26 Feb 2016 08:48:47 -0600 [thread overview]
Message-ID: <56D065CF.9060303@linux.intel.com> (raw)
In-Reply-To: <20160226081455.GH6210@loska>
On 02/26/2016 02:14 AM, Mikko.Rapeli@bmw.de wrote:
> Hi,
>
> On my developer machine the cve-check ran ok for dizzy but on build server
> with sstate-cache and rmwork enabled it failed with what looks like a race
> condition when scanning the patch files:
>
> 17:45:36 ERROR: Error executing a python function in /home/builder/src/base/poky/meta/recipes-extended/mailx/mailx_12.5.bb:
> 17:45:36
> 17:45:36 The stack trace of python calls that resulted in this exception/failure was:
> 17:45:36 File: 'do_cve_check', lineno: 17, function: <module>
> 17:45:36 0013: else:
> 17:45:36 0014: bb.note("Failed to update CVE database, skipping CVE check")
> 17:45:36 0015:
> 17:45:36 0016:
> 17:45:36 *** 0017:do_cve_check(d)
> 17:45:36 0018:
> 17:45:37 File: 'do_cve_check', lineno: 8, function: do_cve_check
> 17:45:37 0004: Check recipe for patched and unpatched CVEs
> 17:45:37 0005: """
> 17:45:37 0006:
> 17:45:37 0007: if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)):
> 17:45:37 *** 0008: patched_cves = get_patches_cves(d)
> 17:45:37 0009: patched, unpatched = check_cves(d, patched_cves)
> 17:45:37 0010: if patched or unpatched:
> 17:45:37 0011: cve_data = get_cve_info(d, patched + unpatched)
> 17:45:37 0012: cve_write_data(d, patched, unpatched, cve_data)
> 17:45:37 File: 'cve-check.bbclass', lineno: 13, function: get_patches_cves
> 17:45:37 0009: cve_match = re.compile("CVE:( CVE\-\d+\-\d+)+")
> 17:45:37 0010: patched_cves = set()
> 17:45:37 0011: for url in src_patches(d):
> 17:45:37 0012: patch_file = bb.fetch.decodeurl(url)[2]
> 17:45:37 *** 0013: with open(patch_file, "r") as f:
> 17:45:37 0014: patch_text = f.read()
> 17:45:37 0015:
> 17:45:37 0016: # Search for the "CVE: " line
> 17:45:37 0017: match = cve_match.search(patch_text)
> 17:45:37 Exception: IOError: [Errno 2] No such file or directory: '/home/builder/src/base/build/tmp/work/corei7-64-linux/mailx/12.5-r2/heirloom-mailx_12.5-1.diff'
> 17:45:37
> 17:45:37 ERROR: Function failed: do_cve_check
>
> So could this be caused by cve-check changes or is this just a side effect
> of some other recipe problems?
>
> I could not see that kind of fixes in master.
>
> -Mikko
The changes in patch series were minimal and actually this part of the
code wasn't touched at all. That part of the code will look for all the
files in the SRC_URI variable and will look for the "CVE:" tag in order
to find patches that solve CVEs.
It seems the problem is with the bitbake fetcher, or the recipe;
unfortunately the fetcher is one of the components that most change
between releases. Another thing to check is that if actually there is a
heirloom-mailx_12.5-1.diff file in the paths that the fetcher look for.
You can check this in the cve_check or patch log in the work directory
of the recipe.
Mariano
next prev parent reply other threads:[~2016-02-26 14:48 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-24 15:27 [PATCH 0/3] Add initial capability to check CVEs for recipes mariano.lopez
2016-02-24 15:27 ` [PATCH 1/3] cve-check-tool: Add recipe mariano.lopez
2016-02-25 0:44 ` Burton, Ross
2016-02-24 15:27 ` [PATCH 2/3] cve-check-tool patch to allow select dir for the db mariano.lopez
2016-02-25 13:33 ` Burton, Ross
2016-02-25 14:46 ` Mariano Lopez
2016-02-24 15:27 ` [PATCH 3/3] cve-check.bbclass: Add class mariano.lopez
2016-02-29 14:50 ` Burton, Ross
2016-02-29 20:06 ` Mariano Lopez
2016-02-25 12:14 ` [PATCH 0/3] Add initial capability to check CVEs for recipes Mikko.Rapeli
2016-02-25 12:29 ` Mikko.Rapeli
2016-02-25 13:27 ` Mikko.Rapeli
2016-02-25 14:09 ` Mikko.Rapeli
2016-02-26 8:14 ` Mikko.Rapeli
2016-02-26 14:48 ` Mariano Lopez [this message]
2016-02-26 14:56 ` Mikko.Rapeli
2016-02-26 14:57 ` Mikko.Rapeli
2016-02-26 15:38 ` Mariano Lopez
2016-02-29 14:17 ` Burton, Ross
2016-02-29 14:19 ` Mikko.Rapeli
2016-03-01 15:15 ` Mariano Lopez
2016-03-02 6:32 ` Mikko.Rapeli
[not found] ` <56CF2B81.4080500@mvista.com>
2016-02-25 17:22 ` Mariano Lopez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56D065CF.9060303@linux.intel.com \
--to=mariano.lopez@linux.intel.com \
--cc=Mikko.Rapeli@bmw.de \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.