Issues with evaluating cve-corrector for meta-lts-collab

[colin-pm]

Hello,

First of all, thank you so much for open sourcing this tool. So far I've been impressed with the state of this tooling and think it holds a lot of promise. I'm very eager to see how I can adopt it for meta-lts-collab's workflows and automated pipelines.

I've been testing out this tool with the Kirkstone branch of meta-lts-collab and have run into a few issues. I've noted those in the PR that's associated with my testing: garmin/meta-lts-collab#189 (comment)

I was hoping I might be able to get some feedback with the issues I've ran into. I know this is testing the tool with EoL versions, which is something you probably don't want to also support. However, I'm happy to collaborate on fixes/features for older Yocto versions that also work with the newer versions.

This is kind of a discussion and not actually identifying a particular issue, but I didn't know where else to start this discussion. Feel free to close this issue if you think an issue is an inappropriate location for this discussion.

Best,
Colin

[danielturull]

Thanks Colin for giving it a try.

I think we can have support for kirkstone. The scripts are using bitbake-getvar but probably we can have a fallback to just do bitbake -e to get the variables that we want.

If we can make this tool use for more people, we can get some momentum and improve it. Then also we reduce the threshold on contributing CVE corrections, and we share more the load. I'm very happy to collaborate adding supported for older yocto releases. Feel free to open PR for the missing parts.

Regarding you findings in the meta-lts-collab.

It'd be nice if the tool either encouraged or automatically denoted that the patch was modified in some way in the patch notes.

For the first part is a good idea. for the second if you run the agent, the agent will denote the changes for you. You might need to edit them and sanity check them.

My main issue was the --bbappend and --meta-layer flags did not work as I would have hoped. The command above added both the patches to the upstream recipe in poky and a bbappend too, not meta-lts-collab.

Probably I need to improve the documentation. I did not test it with poky but with a setup where each meta-layer is a git repository. I should try it with poky. The idea is that the recipe will be updated in --meta-layers and with the bbappend it will create the bbappend.

We have an internal layer to add the bbappend while waiting for upstream or for versions that we deviate from it. probably it needs more testing.

I noticed that running cve-corrector with some recipes fails if CRLF endings exist somewhere in the repo. I would imagine this is a devtool issue, but I'm wondering if there's any mitigation that could be taken by cve-corrector?

Probably we could add some safety guards, I haven't seen in Scarthgap or Wrynose

Thanks again for looking into it and let's collaborate on it.