Add Debian CVE check plugin#596
Merged
hiraku-wfs merged 5 commits intomiraclelinux:emlinux3from Feb 20, 2026
Merged
Conversation
masami256
force-pushed
the
debian-cve-check-plugin
branch
5 times, most recently
from
68b5712 to
f2115ab
Compare
masami256
force-pushed
the
debian-cve-check-plugin
branch
from
f2115ab to
4dd4e59
Compare
We should get OPERATOR_END instead of OPERATOR_START twice. Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
Add plugin disable feature to make easy to disable specific plugin(s). Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
If EMLINUX_SOURCE_FROM it not set, it is difficult to detect source information. Hence, we set unknown to reduce false positive. Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
This commit added debian plugin for check vulnerabilities in debian packages. This plugin checks where the package came from via debian_code name and source_from variables to prevent checking wrong information. Basically, the debian_codename is read from DISTRO variable unless user passes debian_codename option. The source_from variables are read from all-source-infis read from DISTRO variable unless user passes debian_codename option. If the source_from is non-debian or unknown this plugin skips to check the package. Also, if debian codename is not in debian's CVE tracker json file, it also skips. So that, this plugin relies on the debian codename to improve accuracy for checking vulnerabilities . Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
Signed-off-by: Masami Ichikawa <masami.ichikawa@miraclelinux.com>
masami256
force-pushed
the
debian-cve-check-plugin
branch
from
4dd4e59 to
2d4beed
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR add new plugin that run cve check based on the debian security tracker, a bug fix, and some feature improvement.
This PR contains following commits.
This commit updates cve_products.yml and cve_check_ignore.yml files to reduce false positive results.
This is the main commit in the PR. This commit adds the debian cve check plugin.
This commit set "unknown" to EMLINUX_SOURCE_FROM when EMLINUX_SOURCE_FROM variable is not defined in a recipe file instead of set codename from DISTRO variable.
This protects checking from wrong data source.
This commit add a new feature to disable plugin for test purpose. This option support disabling multiple plugins in a same time separating by comma.
Previous code fetches OPERATOR_START column twice. This sql should fetch OPERATOR_START and OPERATOR_END respectably. This commit fixes wrong sql.
Test
Prepare
Create a custom layer and add following recipe to the layer.
Set following variable to local.conf.
Then, build emlinux-image-weston.
Testing basic feature
Run following command.
Testing disable plugin
Run following command.
Test result
Testing basic feature
Following log shows NVD and debian plugin were executed.
Testing disable plugin
Following log show
2026-02-05 01:52:40,748:INFO: Plugin 'eml_cve_debian_plugin' is disabledline.