]> code.ossystems Code Review - openembedded-core.git/commitdiff
cve-check: improve comment about CVE patch file names
authorMichael Opdenacker <michael.opdenacker@bootlin.com>
Thu, 5 Aug 2021 16:50:46 +0000 (18:50 +0200)
committerSteve Sakoman <steve@sakoman.com>
Mon, 16 Aug 2021 14:41:07 +0000 (04:41 -1000)
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8aa613480663e11ecc62278d8c57ca719eb23899)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/classes/cve-check.bbclass

index df6ebfd29dd314ccc5f35762d948ec27d605cae0..f9e5cfa4510b2769ff01e2f821eac6f2501a9b41 100644 (file)
@@ -166,9 +166,12 @@ def get_patches_cves(d):
     pn = d.getVar("PN")
     cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+")
 
-    # Matches last CVE-1234-211432 in the file name, also if written
-    # with small letters. Not supporting multiple CVE id's in a single
-    # file name.
+    # Matches the last "CVE-YYYY-ID" in the file name, also if written
+    # in lowercase. Possible to have multiple CVE IDs in a single
+    # file name, but only the last one will be detected from the file name.
+    # However, patch files contents addressing multiple CVE IDs are supported
+    # (cve_match regular expression)
+
     cve_file_name_match = re.compile(".*([Cc][Vv][Ee]\-\d{4}\-\d+)")
 
     patched_cves = set()