Re: [security-discussions] yocto-security-tools: helper scripts for CVE backporting work

On Tue Jul 21, 2026 at 9:23 AM CEST, Daniel Turull via lists.openembedded.o=
rg wrote:
> Hello,

Hello Daniel,

> I would like to share a set of scripts that I wrote to enable faster
> and more systematic CVE backporting work.=20
>
> https://github.com/Ericsson/yocto-security-tools

That's interesting. Reviewing stable patches, I think there are similar
tools used. Thanks for publishing yours :)

>
> It consists of 3 parts.
>
> * cve-metadata-extractor: Find fix commits for CVEs from multiple
> public sources (Debian, OSV, CVEList V5, Ubuntu, NVD). For the list of
> CVEs uses as input the cve report from sbom-cve-check or a cve id.
>
> * cve-corrector: Automate backporting CVE fixes to Yocto recipes using
> devtool. It mimics how it is done manually and creates a patch ready
> for review. If there are ptest for the package, it will run them before
> and after to check for regressions.
>
> * cve-agent: if there are issues with cve-corrector, like a merge
> conflict or build error, it can trigger an AI-assisted resolution and
> then continue with the cve-corrector. Currently works with Kiro and
> Claude.

I observed some "weirdness" when a patch is passed through a LLM. I
don't if that is the case for your tool but some things to be aware of:
* The LLM tools tend to rewrite the commit message (changing author,
  paraphrasing message, ...) and that should be avoided.
* When then the backport is AI-assisted, it must to be marked as such:
  https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#a=
cceptance-of-ai-generated-code

I recommend running interdiff between the upstream patches and the
output of the tool to help the human author spot backporting mistake
(unnecessary/unexplained changes, paraphrased commit message, ...)

> The license is MIT. Please fill free to take a look, give it a try and
> if you find anything that could be improved, for example, what could be
> included in the commit messages or more sources for cve information,
> please let me known or contribute back.
>
> It is designed in an modular way, so it is easy to extend.
>
> My idea the more people is using it, the more people can work faster on
> backporting CVEs, share the load, and then focusing on features or
> other maintenance. And I know that in an ideal world, we should upgrade
> to the latest versions, but due to stability and testing is difficult,
> even for the latest yocto release.
>
> I have tested it with Scarthgap, Wrynose and master
>
> Best regards,
> Daniel

Regards,
--=20
Yoann Congal
Smile ECS