commit 6e60e8b2b2bab889379b380a28a167a0edd9d1d3
author Brad Bishop <bradleyb@fuzziesquirrel.com> Thu Feb 01 10:27:11 2018 -0500
committer Brad Bishop <bradleyb@fuzziesquirrel.com> Mon Mar 12 22:51:39 2018 -0400
tree f12f54d5ba8e74e67e5fad3651a1e125bb8f4191
parent 509842add85b53e13164c1569a1fd43d5b8d91c5

Yocto 2.3

Move OpenBMC to Yocto 2.3(pyro).

Tested: Built and verified Witherspoon and Palmetto images
Change-Id: I50744030e771f4850afc2a93a10d3507e76d36bc
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Resolves: openbmc/openbmc#2461

import-layers/yocto-poky/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb

diff --git a/import-layers/yocto-poky/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb b/import-layers/yocto-poky/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
index 1baadea..1f906ee 100644
--- a/import-layers/yocto-poky/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
+++ b/import-layers/yocto-poky/meta/recipes-devtools/cve-check-tool/cve-check-tool_5.6.4.bb
@@ -9,18 +9,22 @@
 SRC_URI = "https://github.com/ikeydoherty/${BPN}/releases/download/v${PV}/${BP}.tar.xz \
            file://check-for-malloc_trim-before-using-it.patch \
            file://0001-print-progress-in-percent-when-downloading-CVE-db.patch \
+           file://0001-curl-allow-overriding-default-CA-certificate-file.patch \
+           file://0001-update-Compare-computed-vs-expected-sha256-digit-str.patch \
           "
 
 SRC_URI[md5sum] = "c5f4247140fc9be3bf41491d31a34155"
 SRC_URI[sha256sum] = "b8f283be718af8d31232ac1bfc10a0378fb958aaaa49af39168f8acf501e6a5b"
 
+UPSTREAM_CHECK_URI = "https://github.com/ikeydoherty/cve-check-tool/releases"
+
 DEPENDS = "libcheck glib-2.0 json-glib curl libxml2 sqlite3 openssl ca-certificates"
 
 RDEPENDS_${PN} = "ca-certificates"
 
 inherit pkgconfig autotools
 
-EXTRA_OECONF = "--disable-coverage"
+EXTRA_OECONF = "--disable-coverage --enable-relative-plugins"
 CFLAGS_append = " -Wno-error=pedantic"
 
 do_populate_cve_db() {
@@ -37,7 +41,8 @@
     [ -z "${cve_file}" ] && cve_file="${TMPDIR}/cve_check"
 
     bbdebug 2 "Updating cve-check-tool database located in $cve_dir"
-    if cve-check-update -d "$cve_dir" ; then
+    # --cacert works around curl-native not finding the CA bundle
+    if cve-check-update --cacert ${sysconfdir}/ssl/certs/ca-certificates.crt -d "$cve_dir" ; then
         printf "CVE database was updated on %s UTC\n\n" "$(LANG=C date --utc +'%F %T')" > "$cve_file"
     else
         bbwarn "Error in executing cve-check-update"
@@ -48,6 +53,7 @@
 }
 
 addtask populate_cve_db after do_populate_sysroot
+do_populate_cve_db[depends] = "cve-check-tool-native:do_populate_sysroot"
 do_populate_cve_db[nostamp] = "1"
 do_populate_cve_db[progress] = "percent"