]> code.ossystems Code Review - openembedded-core.git/commit
cve-check: replace Looseversion with custom version class
authorLee Chee Yang <chee.yang.lee@intel.com>
Fri, 22 Jan 2021 10:07:19 +0000 (18:07 +0800)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Sat, 23 Jan 2021 17:08:49 +0000 (17:08 +0000)
commit6ced85e9ddd3569240f1e8b82130d1ac0fffbc40
tree681bd9947b5c54782021cbb073c3845e072f5a01
parent58f8debdd53c27cce17ae083dfeb0dab0bd54964
cve-check: replace Looseversion with custom version class

The way distutils.version.LooseVersion compare version are tricky, it treat
all these ( "1.0-beta2", "1.0-rc1", "1.0A", "1.0p2" and "1.0pre1") as greater
version than "1.0". This might be right for "1.0A" and "1.0p1" but not for
the rest, also these version could be confusing, the "p" in "1.0p1" can be
"pre" or "patched" version or even other meaning.

Replace Looseversion with custom class, it uses regex to capture common
version format like "1.1.1" or tag format using date like "2020-12-12" as
release section, check for following known string/tags ( beta, rc, pre, dev,
alpha, preview) as pre-release section, any other trailing characters
are difficult to understand/define so ignore them. Compare release
section and pre-release section saperately.

included selftest for the version class.

[YOCTO#14127]

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/classes/cve-check.bbclass
meta/lib/oe/cve_check.py [new file with mode: 0644]
meta/lib/oeqa/selftest/cases/cve_check.py [new file with mode: 0644]