| # SPDX-License-Identifier: MIT |
| |
| # Perform CVE analysis on image SBOMs using sbom-cve-check. |
| # |
| # It is recommended to enable this class through the sbom-cve-check fragment: |
| # bitbake-config-build enable-fragment core/yocto/sbom-cve-check |
| # |
| # Or it is possible to add this line in local.conf: |
| # OE_FRAGMENTS += "core/yocto/sbom-cve-check" |
| |
| inherit sbom-cve-check-common |
| |
| python do_sbom_cve_check() { |
| """ |
| Task: Run sbom-cve-check analysis on SBOM. |
| """ |
| sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json") |
| image_name = d.getVar("IMAGE_NAME") |
| link_name = d.getVar("IMAGE_LINK_NAME") |
| run_sbom_cve_check(d, sbom_path, image_name, link_name) |
| } |
| |
| addtask do_sbom_cve_check after do_create_image_sbom_spdx before do_build |
| |
| SSTATETASKS += "do_sbom_cve_check" |
| do_sbom_cve_check[cleandirs] = "${SBOM_CVE_CHECK_DEPLOYDIR}" |
| do_sbom_cve_check[sstate-inputdirs] = "${SBOM_CVE_CHECK_DEPLOYDIR}" |
| do_sbom_cve_check[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}" |
| do_sbom_cve_check[depends] += " \ |
| python3-sbom-cve-check-native:do_populate_sysroot \ |
| ${SBOM_CVE_CHECK_UPDATE_DB_DEPENDENCIES} \ |
| " |
| |
| python do_sbom_cve_check_setscene() { |
| sstate_setscene(d) |
| } |
| addtask do_sbom_cve_check_setscene |
