Skip to content

Replace CVE check - #680

Draft
masami256 wants to merge 2 commits into
miraclelinux:emlinux3from
masami256:replace-cve-check
Draft

Replace CVE check#680
masami256 wants to merge 2 commits into
miraclelinux:emlinux3from
masami256:replace-cve-check

Conversation

@masami256

@masami256 masami256 commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

This PR's main purpose is renamed from cve_check_ng.py to cve_check.py to make it as default cve check script.
There is 2 commits to to make it.

cve-check: Remove cve_check.py and related code

This commit removed cve_check.py and its related files to prepare replacing cve_check_ng.py to rename cve_check.py.

cve-check: Make cve_check_ng.py as default cve check script

It time to change cve_check_ng.py as default cve check script. To make cve_check_ng.py as default scripts, we updated following list.

  • Rename cve_check_ng.py to cve_check.py
  • Remove experimental messages
  • Change CVE report file directory

Notes

Rename cve_check_ng.py to cve_check.py causes made lots of differences between emlinux3 branch and PR's branch because of file name changes. But actual change is here.

$ git diff HEAD~1
diff --git a/scripts/cve_check_ng.py b/scripts/cve_check.py
similarity index 98%
rename from scripts/cve_check_ng.py
rename to scripts/cve_check.py
index 85fb913..d0bf35e 100755
--- a/scripts/cve_check_ng.py
+++ b/scripts/cve_check.py
@@ -384,8 +384,6 @@ def main(args: dict):
     output_base_dir = (
         f"{bitbakeinfo['deploy_dir']}/cve/{bitbakeinfo['image_full_name']}"
     )
-    # Use cve_check_ng scripts own directory for testing
-    output_base_dir = f"{output_base_dir}/cve_check_ng"
 
     reporter = CveReporter(output_base_dir, bitbakeinfo["image_full_name"])
     reporter.write_report(args.output_format, cve_info_list, installed_packages)
@@ -488,7 +486,4 @@ def parse_options():
 
 
 if __name__ == "__main__":
-    logger.info("|------------------------------|")
-    logger.info("| This is experimental version |")
-    logger.info("|------------------------------|")
     main(parse_options())

Test result

Run cve_check.py works fine.

build@e6d3d175fab6:~/work/build$ cve_check.py \
--image emlinux-image-base \
--debian-codename bookworm \
--output-format text,json \
--nvd-api-key <your api key> \
--cve-db-predownload \
--verbose
2026-08-27 05:14:59,940:DEBUG: loading /home/build/work/build/../repos/meta-emlinux/scripts/lib/python/cve/plugin/eml_cve_debian_plugin.py
2026-08-27 05:14:59,941:DEBUG: loading /home/build/work/build/../repos/meta-emlinux/scripts/lib/python/cve/plugin/eml_cve_cip_kernel_plugin.py
2026-08-27 05:14:59,942:DEBUG: loading /home/build/work/build/../repos/meta-emlinux/scripts/lib/python/cve/plugin/eml_cve_nvd_plugin.py
2026-08-27 05:14:59,943:DEBUG: run EmlDebianPlugin
2026-08-27 05:14:59,943:INFO: Update debian CVE database
2026-08-27 05:15:03,430:DEBUG: EmlDebianPlugin: run-check start
2026-08-27 05:15:04,196:DEBUG: run EmlCIPKernelPlugin
2026-08-27 05:15:04,196:INFO: Update cip-kernel-sec CVE database
2026-08-27 05:15:04,196:INFO: clone/update cip-kernel-sec
2026-08-27 05:15:19,288:DEBUG: EmlCIPKernelPlugin: run-check start
2026-08-27 05:15:19,288:DEBUG: Linux kernel package is linux-cip
2026-08-27 05:15:55,985:DEBUG: run EmlNVDPlugin
2026-08-27 05:15:55,985:DEBUG: Initialize nvd cve database /home/build/work/build/downloads/CVE/nvd_cve_db_v2.db.tmp
2026-08-27 05:15:55,992:INFO: Predownload CVE database file.
2026-08-27 05:15:55,992:INFO: Download CVE database file from http://emlinux-pkgs.miraclelinux.com/CVE/emlinux3/nvd_cve_db_v2.db.
2026-08-27 05:16:08,362:INFO: Download CVE database file was succeeded.
2026-08-27 05:16:08,533:INFO: Last database update is in 1 day skip NVD database update
2026-08-27 05:16:08,533:DEBUG: EmlNVDPlugin: run-check start
2026-08-27 05:16:28,190:DEBUG: EmlNVDPlugin: run-check finish
2026-08-27 05:16:28,422:INFO: Update KEV database
2026-08-27 05:16:29,098:INFO: Text report were written to /home/build/work/build/tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/text
2026-08-27 05:16:29,174:INFO: All in one text report was written to /home/build/work/build/tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/emlinux-image-base-emlinux-bookworm-qemu-amd64_cve
2026-08-27 05:16:29,405:INFO: Json report were written to /home/build/work/build/tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/json
2026-08-27 05:16:29,704:INFO: All in one json report was written to /home/build/work/build/tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/emlinux-image-base-emlinux-bookworm-qemu-amd64_cve.json

All report files were stored in same as before(old cve_checck.py).

build@e6d3d175fab6:~/work/build$ ls tmp/deploy/cve/
emlinux-image-base-emlinux-bookworm-qemu-amd64
build@e6d3d175fab6:~/work/build$ ls tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/
emlinux-image-base-emlinux-bookworm-qemu-amd64_cve  emlinux-image-base-emlinux-bookworm-qemu-amd64_cve.json  json  text
build@e6d3d175fab6:~/work/build$ ls tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/text/
acl       attr         bash       cryptsetup  dpkg       gcc-12  gnutls28         iproute2  klibc   libcap2                 libidn2     libtirpc   lvm2     nettle   pcre2   shadow    util-linux
adduser   audit        bzip2      dash        e2fsprogs  glibc   grep             iptables  krb5    libffi                  libseccomp  libxcrypt  lz4      openssl  perl    systemd   vim
apparmor  base-files   coreutils  db5.3       elfutils   gmp     gzip             iputils   libbpf  libfile-find-rule-perl  libsepol    libzstd    mawk     p11-kit  procps  sysvinit  xz-utils
apt       base-passwd  cpio       diffutils   findutils  gnupg2  initramfs-tools  json-c    libbsd  libgcrypt20             libtasn1-6  linux-cip  ncurses  pam      sed     tar       zlib
build@e6d3d175fab6:~/work/build$ ls tmp/deploy/cve/emlinux-image-base-emlinux-bookworm-qemu-amd64/json/
acl_cve.json          cryptsetup_cve.json              glibc_cve.json                klibc_cve.json                   libnumber-compare-perl_cve.json  lz4_cve.json      sysvinit_cve.json
adduser_cve.json      dash_cve.json                    gmp_cve.json                  kmod_cve.json                    libseccomp_cve.json              mawk_cve.json     tar_cve.json
apparmor_cve.json     db5.3_cve.json                   gnupg2_cve.json               krb5_cve.json                    libselinux_cve.json              ncurses_cve.json  tzdata_cve.json
apt_cve.json          debconf_cve.json                 gnutls28_cve.json             libbpf_cve.json                  libsemanage_cve.json             netbase_cve.json  usrmerge_cve.json
argon2_cve.json       debian-archive-keyring_cve.json  grep_cve.json                 libbsd_cve.json                  libsepol_cve.json                nettle_cve.json   util-linux_cve.json
attr_cve.json         debianutils_cve.json             gzip_cve.json                 libcap2_cve.json                 libtasn1-6_cve.json              openssl_cve.json  vim_cve.json
audit_cve.json        diffutils_cve.json               hostname_cve.json             libcap-ng_cve.json               libtext-glob-perl_cve.json       p11-kit_cve.json  xxhash_cve.json
base-files_cve.json   dpkg_cve.json                    initramfs-tools_cve.json      libffi_cve.json                  libtirpc_cve.json                pam_cve.json      xz-utils_cve.json
base-passwd_cve.json  e2fsprogs_cve.json               init-system-helpers_cve.json  libfile-find-rule-perl_cve.json  libunistring_cve.json            pcre2_cve.json    zlib_cve.json
bash_cve.json         elfutils_cve.json                iproute2_cve.json             libgcrypt20_cve.json             libxcrypt_cve.json               perl_cve.json
bzip2_cve.json        emlinux-customization_cve.json   iptables_cve.json             libgpg-error_cve.json            libzstd_cve.json                 procps_cve.json
cdebconf_cve.json     findutils_cve.json               iputils_cve.json              libidn2_cve.json                 linux-base_cve.json              sed_cve.json
coreutils_cve.json    gcc-12_cve.json                  json-c_cve.json               libmd_cve.json                   linux-cip_cve.json               shadow_cve.json
cpio_cve.json         gdbm_cve.json                    keyutils_cve.json             libmnl_cve.json                  lvm2_cve.json                    systemd_cve.json

@masami256
cve-check: Remove cve_check.py and related code
8067206 
This commit removed cve_check.py and its related files to prepare replacing
cve_check_ng.py to rename cve_check.py.

Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
@masami256
cve-check: Make cve_check_ng.py as default cve check script
789920c 
It time to change cve_check_ng.py as default cve check script.
To make cve_check_ng.py as default scripts, we updated following list.

- Rename cve_check_ng.py to cve_check.py
- Remove experimental messages
- Change CVE report file directory

Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@masami256