15305 2023-12-01 16:05:00 +0000 Implementation of packaging tools CVE reporting. 2026-08-20 15:14:57 +0000 1 1 7 Build System, Metadata & Runtime OE-Core deployment unspecified x86 Multiple NEW Low enhancement Future 1 jpuhlman unassigned david.reyna liezhi.yang randy.macleod --- --- Yes (doc changes required) oldest_to_newest 97398 0 jpuhlman 2023-12-01 16:05:00 +0000 With in dnf there is a mechanism for reporting advisories. The generated xml file is UPDATEINFO.xml similar to below. https://download.rockylinux.org/pub/rocky/9.3/BaseOS/x86_64/os/repodata/d9675e6d-d2b8-46d4-977f-de7f2e7fe6f1-UPDATEINFO.xml.gz With a combination of the spdx data and cve-checker, it would likely be possible to generate the data for the created dnf repositories to provide that mechanism on the run time system if dnf is available in the system. Some cve scanners can use the data from dnf to make some of its evaluations which would help in runtime system checking. 106597 1 randy.macleod 2026-08-20 15:14:57 +0000 Still possible but a low priority for Yocto according to RP and Paul Barker and the YP bugboard. If someone who wants this feature can implement it and share, that's great.