Bug 15305

Summary: Implementation of packaging tools CVE reporting.
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Jeremy A. Puhlman <jpuhlman>
Component: deploymentAssignee: Unassigned <unassigned>
Status: NEW --- QA Contact:
Severity: enhancement    
Priority: Low CC: david.reyna, liezhi.yang, randy.macleod
Version: unspecified   
Target Milestone: Future   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Yes (doc changes required)

Description Jeremy A. Puhlman 2023-12-01 16:05:00 UTC 
With in dnf there is a mechanism for reporting advisories.

The generated xml file is UPDATEINFO.xml similar to below.

https://download.rockylinux.org/pub/rocky/9.3/BaseOS/x86_64/os/repodata/d9675e6d-d2b8-46d4-977f-de7f2e7fe6f1-UPDATEINFO.xml.gz

With a combination of the spdx data and cve-checker, it would likely be possible to generate the data for the created dnf repositories to provide that mechanism on the run time system if dnf is available in the system. Some cve scanners can use the data from dnf to make some of its evaluations which would help in runtime system checking.
Comment 1 Randy MacLeod 2026-08-20 15:14:57 UTC 
Still possible but a low priority for Yocto according to RP and Paul Barker and the YP bugboard.

If someone who wants this feature can implement it and share, that's great.