11026 2017-02-07 18:19:05 +0000 cve-check: Error in executing cve-check-update 2017-02-23 16:08:52 +0000 1 1 7 Build System, Metadata & Runtime Security - Recipe Upgrade security 2.3 x86 Multiple RESOLVED FIXED Medium+ normal 2.3 M3 1 sona.sarmadi jku bluelightning --- --- No (bug/feature does not impact docs) oldest_to_newest 70509 0 sona.sarmadi 2017-02-07 18:19:05 +0000 cve-check tool does not work on master and latest morty branch: poky/build-cve-check$ bitbake -k -c cve_check universe WARNING: cve-check-tool-native-5.6.4-r0 do_populate_cve_db: Error in executing cve-check-update WARNING: cve-check-tool-native-5.6.4-r0 do_populate_cve_db: Failed to update cve-check-tool database, CVEs won't be checked do_populate_cve_db() { if [ "${BB_NO_NETWORK}" = "1" ] ; then bberror "BB_NO_NETWORK is set; Can't update cve-check-tool database, CVEs won't be checked" return fi # In case we don't inherit cve-check class, use default values defined in the class. cve_dir="${CVE_CHECK_DB_DIR}" cve_file="${CVE_CHECK_TMP_FILE}" [ -z "${cve_dir}" ] && cve_dir="${DL_DIR}/CVE_CHECK" [ -z "${cve_file}" ] && cve_file="${TMPDIR}/cve_check" bbdebug 2 "Updating cve-check-tool database located in $cve_dir" if cve-check-update -d "$cve_dir" ; then printf "CVE database was updated on %s UTC\n\n" "$(LANG=C date --utc +'%F %T')" > "$cve_file" else bbwarn "Error in executing cve-check-update" <<<<<<<<<<<<<<<<<<<<<<<<< if [ "${@'1' if bb.data.inherits_class('cve-check', d) else '0'}" -ne 0 ] ; then bbwarn "Failed to update cve-check-tool database, CVEs won't be checked" <<<<<<<<<<<<<<<<<<<<<< fi fi } 70510 1 sona.sarmadi 2017-02-07 18:23:14 +0000 On 6 February 2017 at 16:56, Burton, Ross <ross.burton@intel.com> wrote: This definitely needs to be rewritten so you can see the output if it fails. Just run cve-check-update -d <dir> yourself and see what it says. Last time I had this failing it was because the mitre servers were offline. Jussi: Agreed about the error output. I think recipe specific sysroots broke the setup somehow (so the tools are not actually in sysroot when they're needed). I'm taking a look at this tomorrow. Jussi 70911 2 jku 2017-02-23 16:08:52 +0000 Fixed in master with these patches. commit d887c24d5af0f570a259985fa99af5c56158fcfa Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Thu Feb 9 21:38:33 2017 +0200 cve-check-tool: Use CA cert bundle in correct sysroot Native libcurl looks for CA certs in the wrong place by default. * Add patch that allows overriding the default CA certificate location. Patch is originally from meta-security-isafw. * Use the new --cacert to set the correct CA bundle path (From OE-Core rev: 73bd11d5190a072064128cc13b4537154d07b129) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> commit ea616d122676e7d5bbf606b7dbfa8f62c63d4a27 Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Thu Feb 9 21:38:32 2017 +0200 cve-check-tool: Fixes for recipe sysroots * Use --enable-relative-plugins so cve-check-tool looks for loadable modules relative to binary location instead of hard-coding a wrong sysroot location * do_populate_cve_db() assumes that the binary cve-check-update is in the sysroot. Ensure that this is true by adding a task dependency (From OE-Core rev: 2da6b01893d0afe8750bd0b12a8d55aafa82f58c) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> commit 0d637857f2a8387e38da2ed590a10daf595ed124 Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Thu Feb 9 21:38:31 2017 +0200 cve-check.bbclass: Fix dependencies With recipe-specific sysroots the cve_check task must depend on cve-check-tool-native:do_populate_sysroot to get the cve-check-tool binary into the recipe sysroot. A normal DEPENDS isn't used to avoid cyclic dependencies. (From OE-Core rev: bd60b1018bc0304bc928701e6d1090c8b1223616) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>