WARNING: cve-update-db-native-1.0-r0 do_fetch: Failed to fetch CVE data (HTTP Error 503: Service Unavailable) WARNING: cve-update-db-native-1.0-r0 do_fetch: Host IPs are 2600:1f18:268d:1d01:f609:5e91:8a48:f546, 18.235.227.114 https://autobuilder.yoctoproject.org/typhoon/#/builders/138/builds/425/steps/11/logs/stdio https://autobuilder.yoctoproject.org/typhoon/#/builders/138/builds/423/steps/11/logs/stdio https://autobuilder.yoctoproject.org/typhoon/#/builders/138/builds/417/steps/12/logs/stdio https://autobuilder.yoctoproject.org/typhoon/#/builders/138/builds/411/steps/11/logs/stdio
We've been fighting with this too. With cve-check enabled in the build we've been hitting: [18:20:45]W: [Step 1/1] ERROR: cve-update-nvd2-native-1.0-r0 do_fetch: Error executing a python function in exec_func_python() autogenerated: ... [18:20:45]W: [Step 1/1] Exception: urllib.error.HTTPError: HTTP Error 503: Service Unavailable The issue here is that there's only one remote URL defined in the recipe: https://services.nvd.nist.gov/rest/json/cves/2.0 Sometimes it spits out 503 - but no wonder, it's serving paginated 4MB JSONs. And while it works on a good day, it's been broken lately and we had to disable cve-check functionality altogether. That being said, i conclude that the service is currently not reliable enough. The python script needs either to retry and wait or it should use some other source for the CVEs.
Fixed with a series of patches: https://git.openembedded.org/openembedded-core/commit/?id=88dad8f198baa80af5ab576498f4df6ed639d551 https://git.openembedded.org/openembedded-core/commit/?id=f4d118af2360cff7f234102fd5e4b65a6f4146a6 Patches also backported to stable branches