Re: [OE-core] [poky][master][PATCH 1/3] cve_check.py: Add new method get_ignored_cves

[Marta Rybczynska <rybczynska@gmail.com>]

On Wed, May 18, 2022 at 12:33 PM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Wed, 2022-05-18 at 02:46 -0700, akash hadke via
> lists.openembedded.org wrote:
> > Hi Richard,
> >
> > I tried modifying the cve-check.bbclass but did not able to get the
> > solution for disabling the NVD data, because when we inherit cve-
> > check it executes the cve_check task that checks CVEs from NVD DB. So
> > I am also not sure how to disable it hence I used the separate
> > bbclass.
>
> I guess the task dependencies are a bit of an issue there. There are
> probably ways to make those configurable, it would just take a little
> work.
>
> I really do want to encourage us to work together on common cve tooling
> rather than having several partial implementations so I can't take this
> patch series.
>

I plan to cut those dependencies and make different stages optional.
In my case the first use
is to be able to run multiple cve-checks with the same database
(guaranteed without updates)
or run cve-check with some given known database (for testing).
We can add an option to make the actual check with the database optional.

Exporting the data to the buildhistory looks like a useful thing to do, too.

I can draft the split after YPS.

Kind regards,
Marta