Bug 15305 - Implementation of packaging tools CVE reporting.
Summary: Implementation of packaging tools CVE reporting.
Status: NEW
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: deployment (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Low enhancement
Target Milestone: Future
Assignee: Unassigned
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2023-12-01 16:05 UTC by Jeremy A. Puhlman
Modified: 2026-08-20 15:14 UTC (History)
3 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremy A. Puhlman 2023-12-01 16:05:00 UTC 
With in dnf there is a mechanism for reporting advisories.

The generated xml file is UPDATEINFO.xml similar to below.

https://download.rockylinux.org/pub/rocky/9.3/BaseOS/x86_64/os/repodata/d9675e6d-d2b8-46d4-977f-de7f2e7fe6f1-UPDATEINFO.xml.gz

With a combination of the spdx data and cve-checker, it would likely be possible to generate the data for the created dnf repositories to provide that mechanism on the run time system if dnf is available in the system. Some cve scanners can use the data from dnf to make some of its evaluations which would help in runtime system checking.
Comment 1 Randy MacLeod 2026-08-20 15:14:57 UTC 
Still possible but a low priority for Yocto according to RP and Paul Barker and the YP bugboard.

If someone who wants this feature can implement it and share, that's great.