16306 2026-06-05 08:02:08 +0000 AB-INT: metrics: sbom-cve-check: unable to access 'https://github.com/CVEProject/cvelistV5.git/' 2026-10-19 18:56:52 +0000 1 1 5 Infrastructure Infrastructure General infrastructure-general unspecified x86 Multiple RESOLVED FIXED AB-INT Medium+ normal 6.1 M3 1 mathieu.dubois-briand paul paul randy.macleod yoann.congal --- --- No (bug/feature does not impact docs) oldest_to_newest 105740 0 mathieu.dubois-briand 2026-06-05 08:02:08 +0000 Does the "error setting certificate file" mean something went wrong locally? ERROR: meta-world-recipe-sbom-1.0-r0 do_sbom_cve_check_recipe: sbom-cve-check failed: Execution of '/srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json' failed with exit code 1: ERROR:sbom_cve_check.cli:cvelist database init failed. `['git', 'fetch', '-f', 'origin', 'refs/heads/main:refs/remotes/origin/main']` failed: --- fatal: unable to access 'https://github.com/CVEProject/cvelistV5.git/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/etc/ssl/certs/ca-certificates.crt 105751 1 mathieu.dubois-briand 2026-06-05 08:15:33 +0000 metrics alma8-vk-1 2.18&wrynose completed at 2026-06-04 07:12:22+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3440/steps/17/logs/stdio 105822 2 ross.burton 2026-06-11 14:36:38 +0000 Note how the certificate path is a SDK pre-relocation path and this is on alma8 which uses buildtools, so a SDK. Something didn't relocate? 105904 3 ross.burton 2026-06-17 09:34:32 +0000 So my working theory is that the problem here is that the autobuilder scripts support buildtools by scanning the environment script for exports and adding them to an environment. However, the SSL certificate setting isn't done with a simple export but instead with logic. I think the solution here is to either wrap every call in helper with a potential call to the environment script, or to actually run the environment script once and harvest the environment. 105906 4 ross.burton 2026-06-17 14:49:39 +0000 Writing down my half-formed ideas before I forget them. Where the current code tries to parse the buildtools environment script, instead do something like this: $ . environment-setup-aarch64-pokysdk-linux && python3 -c 'import os,json; print(json.dumps(dict(os.environ)))' {"SHELL": "/bin/bash", "OPENSSL_ENGINES": "/home/rosbur01/Scratch/buildtools-6.0/sysroots/aarch64-pokysdk-linux/usr/lib/engines-3", ... This gives us a JSON string we can then parse (and just dump as an error message if it can't be parsed) which can then be used to update the environment dictionary. 106492 5 mathieu.dubois-briand 2026-08-11 14:54:45 +0000 metrics alma8-vk-2 wrynose&2.18 completed at 2026-08-08 07:24:17+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3831/steps/19/logs/stdio 106509 6 mathieu.dubois-briand 2026-08-13 06:23:42 +0000 metrics alma9-vk-2 2.18&wrynose completed at 2026-08-12 07:33:20+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3855/steps/19/logs/stdio 106520 7 randy.macleod 2026-08-13 14:50:52 +0000 Apparently on on wrynose. Is the buildtools tarball missing a bug fix ? 106536 8 mathieu.dubois-briand 2026-08-14 06:15:22 +0000 metrics alma8-vk-1 wrynose&2.18 completed at 2026-08-13 07:36:01+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3861/steps/19/logs/stdio 106555 9 richard.purdie 2026-08-18 21:19:32 +0000 The environment for buildtools tarball isn't being correctly applied. This is fixed in helper: https://git.yoctoproject.org/yocto-autobuilder-helper/commit/?id=ff7149fe675bff1f57f4f46c0efc5dd5029ce001 https://git.yoctoproject.org/yocto-autobuilder-helper/commit/?h=wrynose&id=0b2dce87e3324e3ec4db1ff3d8d861a8d7d295cc 106690 10 mathieu.dubois-briand 2026-08-31 10:23:57 +0000 Looks like it happened again. metrics stream9-vk-1 master completed at 2026-08-31 07:58:44+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3970/steps/24/logs/stdio 106705 11 mathieu.dubois-briand 2026-09-03 08:06:10 +0000 Reopening. 106710 12 mathieu.dubois-briand 2026-09-03 08:11:35 +0000 metrics alma9-vk-2 master completed at 2026-09-03 07:50:20+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3988/steps/19/logs/stdio 106720 13 richard.purdie 2026-09-03 15:52:03 +0000 More logs from the logfile: DEBUG: Executing python function do_sbom_cve_check_recipe NOTE: Running: /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json ERROR: sbom-cve-check failed: Execution of '/srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json' failed with exit code 1: ERROR:sbom_cve_check.cli:cvelist database init failed. `['git', 'fetch', '-f', 'origin', 'refs/heads/main:refs/remotes/origin/main']` failed: --- fatal: unable to access 'https://github.com/CVEProject/cvelistV5.git/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/etc/ssl/certs/ca-certificates.crt 106721 14 richard.purdie 2026-09-03 15:52:31 +0000 If --disable-auto-updates is set, should it try and init the database? 106735 15 richard.purdie 2026-09-04 16:47:57 +0000 It is a git fetch, which suggests that it is actually trying to update. As such this is probably a but in sbom-cve-check. 106814 16 mathieu.dubois-briand 2026-09-11 08:13:10 +0000 On wrynose, we probably just need a backport. metrics alma8-vk-2 2.18&wrynose completed at 2026-09-11 07:47:15+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4035/steps/24/logs/stdio 106815 17 yoann.congal 2026-09-11 08:52:34 +0000 I think this particular bug is fixed, on master by: * python3-sbom-cve-check: update to version 1.3.4 https://git.openembedded.org/openembedded-core/commit/?id=9fcb4b9b16594710b8be34b228042c426b48ee0e * sbom-cve-check: enable offline mode https://git.openembedded.org/openembedded-core/commit/?id=db2e0fdf82af5b50053840e522bf72550d1cbe66 (In reply to Mathieu Dubois-Briand from comment #16) > On wrynose, we probably just need a backport. I need to discuss this: the sbom-cve-check 1.3.4 upgrade is not as clearly stable (wrt our stable policy) as I usually accept: * sbom-cve-check/CHANGELOG.md at v1.3.4 · bootlin/sbom-cve-check https://github.com/bootlin/sbom-cve-check/blob/v1.3.4/CHANGELOG.md#v134 * Comparing v1.3.3...v1.3.4 · bootlin/sbom-cve-check https://github.com/bootlin/sbom-cve-check/compare/v1.3.3...v1.3.4 107121 18 paul 2026-10-19 18:56:52 +0000 sbom-cve-check 1.3.5 is merged to wrynose, so this can be closed. https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=c7f050793137ae539efc826e4050a2d0f08c33ac