spdx30: handle Unknown CVE_STATUS

CVE_STATUS can be also "Unknown" since oe-core commit
d25f1817752bc8a84c40dcbef75f7559801ce15e

When this status type is used, build fails with e.g.
ERROR: openssl-3.4.1-r0 do_create_spdx: Unknown CVE-2025-0001 status 'Unknown'

Since this is now a valid status, it needs to be handled.
It cannot be mapped to any VEX status (see below), so just skip it.
Possible VEX statuses are: NOT AFFECTED, AFFECTED, FIXED, and UNDER INVESTIGATION.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
cc: Marta Rybczynska <rybczynska@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 52329760b6a90e4b25486002ba4fcea2e75e42d6..ba965821f86ef58b1d186ed68665088cbf607495 100644 (file)
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -724,6 +724,8 @@ def create_spdx(d):
                                 )
                         else:
                             bb.fatal(f"Unknown detail '{detail}' for ignored {cve}")
+                    elif status == "Unknown":
+                        bb.note(f"Skipping {cve} with status 'Unknown'")
                     else:
                         bb.fatal(f"Unknown {cve} status '{status}'")