From: Peter Marko Date: Tue, 18 Nov 2025 12:08:39 +0000 (+0100) Subject: spdx30: fix cve status for patch files in VEX X-Git-Tag: 2024-04.15-scarthgap~67 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8d14b2bb02861612130f02c445392f34090ba5d9;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git spdx30: fix cve status for patch files in VEX This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98 which adapts vex creation between function create_spdx where all changes were backported and funtion get_patched_cves where changes were not backported. CVE patches were previously ignored as they cannot be decoded from CVE_STATUS variables and each caused a warning like: WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — missing or unknown CVE status Master branch uses fix-file-included for CVE patches however since cve-check-map.conf was not part of spdx-3.0 backport, closest one available (backported-patch) was implemented. Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 6b0aa137c4..8115088ab8 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -503,7 +503,13 @@ def create_spdx(d): if include_vex != "none": patched_cves = oe.cve_check.get_patched_cves(d) for cve_id in patched_cves: - mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id) + # decode_cve_status is decoding CVE_STATUS, so patch files need to be hardcoded + if cve_id in (d.getVarFlags("CVE_STATUS") or {}): + mapping, detail, description = oe.cve_check.decode_cve_status(d, cve_id) + else: + mapping = "Patched" + detail = "backported-patch" # fix-file-included is not available in scarthgap + description = None if not mapping or not detail: bb.warn(f"Skipping {cve_id} — missing or unknown CVE status")