GitLab

Otherwise only the first package's details are shown

Currently, the following behavior is not tested:
* Specifying an alternate name in the "# secfixes:" comment

Signed-off-by: Max Rees <maxcrees@me.com>

update: Compare computed vs expected sha256 digit string ignoring case

Fix freeing memory allocated by sqlite

We produce sha256 digest string using %x snprintf()
qualifier for each byte of digest which uses alphabetic
characters from "a" to "f" in lower case to represent
integer values from 10 to 15.

Previously all of the NVD META files supply sha256
digest string for corresponding XML file in lower case.

However due to some reason this changed recently to
provide digest digits in upper case causing fetched
data consistency checks to fail. This prevents database
from being updated periodically.

While commit c4f6e945

 (update: Do not treat sha256 failure
as fatal if requested) adds useful option to skip
digest validation at all and thus provides workaround for
this situation, it might be unacceptable for some
deployments where we need to ensure that downloaded
data is consistent before start parsing it and update
SQLite database.

Use strcasecmp() to compare two digest strings case
insensitively and addressing this case.
Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>

The NVD database is known to have issues during early morning whereby
the meta files don't actually match the sha256 of the target xml feed.
This has caused problems for some users of cve-check-tool, so in this
case we will now continue as if nothing fatal had happened if we find
the CVE_SKIP_VERIFY variable in the environment.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Cleanup

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

This alleviates issues with flags not propogating to the plugins which
in turn leads to undefined symbols when coverage is enabled during the
test suites.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

This is now a hard requirement for current pull requests
to ensure we don't walk back into this messy codebase
situation again.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

version mapping support

Current glib versions causes build failures with GCC6 when using -Wpedantic,
so we ensure this is now non-fatal until it is resolved.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Similar to curl, --cacert can now be used in cve-check-tool and
cve-check-update to override the default CA certificate file. Useful
in cases where the system default is unsuitable (for example,
out-dated) or broken (as in OE's current native libcurl, which embeds
a path string from one build host and then uses it on another although
the right path may have become something different).
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>

---
Rebased due to conflicts
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

CVE version string fractional compare

Check for malloc_trim before using it

malloc_trim is gnu specific and not all libc
implement it, threfore write a configure check
to poke for it first and use the define to
guard its use.

Helps in compiling on musl based systems
Signed-off-by: Khem Raj <raj.khem@gmail.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Now this is the last change on this branch.. Work will now be happening on
the `2` branch to clean everything up.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

This allows finer integration into ISAFW, in that cve-check-tool will be
installed in a "syroot" mode, not a "host" mode. In this mode, cve-check-tool
will search for the directories ../lib/cve-check-tool and ../lib64/cve-check-tool
relative to it's main binary for the modules, in addition to the normal
host directory.

Note that this behaviour is disabled by default, as it's not meant to be used
in native-installed deployments due to the nature of forming .so loading paths
relative to /proc/self/exe.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>

Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>