Does the "error setting certificate file" mean something went wrong locally? ERROR: meta-world-recipe-sbom-1.0-r0 do_sbom_cve_check_recipe: sbom-cve-check failed: Execution of '/srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json' failed with exit code 1: ERROR:sbom_cve_check.cli:cvelist database init failed. `['git', 'fetch', '-f', 'origin', 'refs/heads/main:refs/remotes/origin/main']` failed: --- fatal: unable to access 'https://github.com/CVEProject/cvelistV5.git/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/etc/ssl/certs/ca-certificates.crt
metrics alma8-vk-1 2.18&wrynose completed at 2026-06-04 07:12:22+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3440/steps/17/logs/stdio
Note how the certificate path is a SDK pre-relocation path and this is on alma8 which uses buildtools, so a SDK. Something didn't relocate?
So my working theory is that the problem here is that the autobuilder scripts support buildtools by scanning the environment script for exports and adding them to an environment. However, the SSL certificate setting isn't done with a simple export but instead with logic. I think the solution here is to either wrap every call in helper with a potential call to the environment script, or to actually run the environment script once and harvest the environment.
Writing down my half-formed ideas before I forget them. Where the current code tries to parse the buildtools environment script, instead do something like this: $ . environment-setup-aarch64-pokysdk-linux && python3 -c 'import os,json; print(json.dumps(dict(os.environ)))' {"SHELL": "/bin/bash", "OPENSSL_ENGINES": "/home/rosbur01/Scratch/buildtools-6.0/sysroots/aarch64-pokysdk-linux/usr/lib/engines-3", ... This gives us a JSON string we can then parse (and just dump as an error message if it can't be parsed) which can then be used to update the environment dictionary.
metrics alma8-vk-2 wrynose&2.18 completed at 2026-08-08 07:24:17+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3831/steps/19/logs/stdio
metrics alma9-vk-2 2.18&wrynose completed at 2026-08-12 07:33:20+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3855/steps/19/logs/stdio
Apparently on on wrynose. Is the buildtools tarball missing a bug fix ?
metrics alma8-vk-1 wrynose&2.18 completed at 2026-08-13 07:36:01+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3861/steps/19/logs/stdio
The environment for buildtools tarball isn't being correctly applied. This is fixed in helper: https://git.yoctoproject.org/yocto-autobuilder-helper/commit/?id=ff7149fe675bff1f57f4f46c0efc5dd5029ce001 https://git.yoctoproject.org/yocto-autobuilder-helper/commit/?h=wrynose&id=0b2dce87e3324e3ec4db1ff3d8d861a8d7d295cc
Looks like it happened again. metrics stream9-vk-1 master completed at 2026-08-31 07:58:44+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3970/steps/24/logs/stdio
Reopening.
metrics alma9-vk-2 master completed at 2026-09-03 07:50:20+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/3988/steps/19/logs/stdio
More logs from the logfile: DEBUG: Executing python function do_sbom_cve_check_recipe NOTE: Running: /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json ERROR: sbom-cve-check failed: Execution of '/srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/recipe-sysroot-native/usr/bin/sbom-cve-check --sbom-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/deploy/images/qemux86-64/world-recipe-sbom.spdx.json --disable-auto-updates --export-process-native both --export-type spdx3 --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.spdx.json --export-type yocto-cve-check-manifest --export-path /srv/pokybuild/yocto-worker/metrics/build/build/tmp/work/qemux86_64-poky-linux/meta-world-recipe-sbom/1.0/sbom-cve-check/image-deploy/world-recipe-sbom.sbom-cve-check.yocto.json' failed with exit code 1: ERROR:sbom_cve_check.cli:cvelist database init failed. `['git', 'fetch', '-f', 'origin', 'refs/heads/main:refs/remotes/origin/main']` failed: --- fatal: unable to access 'https://github.com/CVEProject/cvelistV5.git/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/etc/ssl/certs/ca-certificates.crt
If --disable-auto-updates is set, should it try and init the database?
It is a git fetch, which suggests that it is actually trying to update. As such this is probably a but in sbom-cve-check.
On wrynose, we probably just need a backport. metrics alma8-vk-2 2.18&wrynose completed at 2026-09-11 07:47:15+00:00 https://autobuilder.yoctoproject.org/valkyrie/#/builders/103/builds/4035/steps/24/logs/stdio
I think this particular bug is fixed, on master by: * python3-sbom-cve-check: update to version 1.3.4 https://git.openembedded.org/openembedded-core/commit/?id=9fcb4b9b16594710b8be34b228042c426b48ee0e * sbom-cve-check: enable offline mode https://git.openembedded.org/openembedded-core/commit/?id=db2e0fdf82af5b50053840e522bf72550d1cbe66 (In reply to Mathieu Dubois-Briand from comment #16) > On wrynose, we probably just need a backport. I need to discuss this: the sbom-cve-check 1.3.4 upgrade is not as clearly stable (wrt our stable policy) as I usually accept: * sbom-cve-check/CHANGELOG.md at v1.3.4 · bootlin/sbom-cve-check https://github.com/bootlin/sbom-cve-check/blob/v1.3.4/CHANGELOG.md#v134 * Comparing v1.3.3...v1.3.4 · bootlin/sbom-cve-check https://github.com/bootlin/sbom-cve-check/compare/v1.3.3...v1.3.4
sbom-cve-check 1.3.5 is merged to wrynose, so this can be closed. https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=c7f050793137ae539efc826e4050a2d0f08c33ac