mbox series

[0/4] RFC: detect CVEs from embedded mbedtls

Message ID 20231019105552.3631582-1-mikko.rapeli@linaro.org
Headers show
Series RFC: detect CVEs from embedded mbedtls | expand

Message

Mikko Rapeli Oct. 19, 2023, 10:55 a.m. UTC
mbedtls is used inside tf-a and tf-m recipes and it's embedded using
SRC_URI to the build workspace. While it would better to use mbedtls
recipe from meta-openembedded, if at possible at all, at least try to
detect CVEs from current setup by setting CVE_PRODUCT and CVE_VERSION
for the embedded mbedtls.

RFC since depends on poky cve-check.bbclass patch
"cve-check.bbclass: support embedded SW components with different version number"
https://lists.openembedded.org/g/openembedded-core/message/189260

Mikko Rapeli (4):
  trusted-firmware-a: include BSD-2-Clause license
  trusted-firmware-a: set version of mbed_tls for CVE check
  trusted-firmware-m: set CVE product and version for mbedtls
  trusted-firmware-a: set CVE_VERSION for mbedtls too

 .../trusted-firmware-a/trusted-firmware-a_2.8.6.bb            | 2 +-
 .../recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc     | 4 +++-
 .../trusted-firmware-a/trusted-firmware-a_2.9.0.bb            | 2 +-
 .../trusted-firmware-m/trusted-firmware-m-1.8.1-src.inc       | 2 +-
 .../recipes-bsp/trusted-firmware-m/trusted-firmware-m.inc     | 2 ++
 5 files changed, 8 insertions(+), 4 deletions(-)