vasilito
f31522130f
Build system (5 gaps hardened): - COOKBOOK_OFFLINE defaults to true (fork-mode) - normalize_patch handles diff -ruN format - New 'repo validate-patches' command (25/25 relibc patches) - 14 patched Qt/Wayland/display recipes added to protected list - relibc archive regenerated with current patch chain Boot fixes (fixable): - Full ISO EFI partition: 16 MiB → 1 MiB (matches mini, BIOS hardcoded 2 MiB offset) - D-Bus system bus: absolute /usr/bin/dbus-daemon path (was skipped) - redbear-sessiond: absolute /usr/bin/redbear-sessiond path (was skipped) - daemon framework: silenced spurious INIT_NOTIFY warnings for oneshot_async services (P0-daemon-silence-init-notify.patch) - udev-shim: demoted INIT_NOTIFY warning to INFO (expected for oneshot_async) - relibc: comprehensive named semaphores (sem_open/close/unlink) replacing upstream todo!() stubs - greeterd: Wayland socket timeout 15s → 30s (compositor DRM wait) - greeter-ui: built and linked (header guard unification, sem_compat stubs removed) - mc: un-ignored in both configs, fixed glib/libiconv/pcre2 transitive deps - greeter config: removed stale keymapd dependency from display/greeter services - prefix toolchain: relibc headers synced, _RELIBC_STDLIB_H guard unified Unfixable (diagnosed, upstream): - i2c-hidd: abort on no-I2C-hardware (QEMU) — process::exit → relibc abort - kded6/greeter-ui: page fault 0x8 — Qt library null deref - Thread panics fd != -1 — Rust std library on Redox - DHCP timeout / eth0 MAC — QEMU user-mode networking - hwrngd/thermald — no hardware RNG/thermal in VM - live preload allocation — BIOS memory fragmentation, continues on demand
91 lines
2.7 KiB
CMake
91 lines
2.7 KiB
CMake
# Copyright (C) 2024 The Qt Company Ltd.
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
# Computes a security CPE for a given set of attributes.
|
|
#
|
|
# When a part is not specified, a wildcard is added.
|
|
#
|
|
# References:
|
|
# https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f22-cpe23type
|
|
# https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf
|
|
# https://nvd.nist.gov/products/cpe
|
|
#
|
|
# Each attribute means:
|
|
# 1. part
|
|
# 2. vendor
|
|
# 3. product
|
|
# 4. version
|
|
# 5. update
|
|
# 6. edition
|
|
# 7. language
|
|
# 8. sw_edition
|
|
# 9. target_sw
|
|
# 10. target_hw
|
|
# 11. other
|
|
function(_qt_internal_sbom_compute_security_cpe out_cpe)
|
|
set(opt_args "")
|
|
set(single_args
|
|
PART
|
|
VENDOR
|
|
PRODUCT
|
|
VERSION
|
|
UPDATE
|
|
EDITION
|
|
)
|
|
set(multi_args "")
|
|
cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
|
|
_qt_internal_validate_all_args_are_parsed(arg)
|
|
|
|
set(cpe_template "cpe:2.3:PART:VENDOR:PRODUCT:VERSION:UPDATE:EDITION:*:*:*:*:*")
|
|
|
|
set(cpe "${cpe_template}")
|
|
foreach(attribute_name IN LISTS single_args)
|
|
if(arg_${attribute_name})
|
|
set(${attribute_name}_value "${arg_${attribute_name}}")
|
|
else()
|
|
if(attribute_name STREQUAL "PART")
|
|
set(${attribute_name}_value "a")
|
|
else()
|
|
set(${attribute_name}_value "*")
|
|
endif()
|
|
endif()
|
|
string(REPLACE "${attribute_name}" "${${attribute_name}_value}" cpe "${cpe}")
|
|
endforeach()
|
|
|
|
set(${out_cpe} "${cpe}" PARENT_SCOPE)
|
|
endfunction()
|
|
|
|
# Computes the default security CPE for a given qt repository.
|
|
function(_qt_internal_sbom_get_cpe_qt_repo out_var)
|
|
_qt_internal_sbom_get_root_project_name_lower_case(repo_project_name_lowercase)
|
|
_qt_internal_sbom_compute_security_cpe(repo_cpe
|
|
VENDOR "qt"
|
|
PRODUCT "${repo_project_name_lowercase}"
|
|
VERSION "${QT_REPO_MODULE_VERSION}"
|
|
)
|
|
set(${out_var} "${repo_cpe}" PARENT_SCOPE)
|
|
endfunction()
|
|
|
|
# Computes the default security CPE for the Qt framework.
|
|
function(_qt_internal_sbom_get_cpe_qt out_var)
|
|
_qt_internal_sbom_compute_security_cpe(qt_cpe
|
|
VENDOR "qt"
|
|
PRODUCT "qt"
|
|
VERSION "${QT_REPO_MODULE_VERSION}"
|
|
)
|
|
set(${out_var} "${qt_cpe}" PARENT_SCOPE)
|
|
endfunction()
|
|
|
|
# Computes the list of security CPEs for Qt, including both the repo-specific one and generic one.
|
|
function(_qt_internal_sbom_compute_security_cpe_for_qt out_cpe_list)
|
|
set(cpe_list "")
|
|
|
|
_qt_internal_sbom_get_cpe_qt(qt_cpe)
|
|
list(APPEND cpe_list "${qt_cpe}")
|
|
|
|
_qt_internal_sbom_get_cpe_qt_repo(repo_cpe)
|
|
list(APPEND cpe_list "${repo_cpe}")
|
|
|
|
set(${out_cpe_list} "${cpe_list}" PARENT_SCOPE)
|
|
endfunction()
|