Skip to content

Home

Jump to bottom
Alba Herrerías edited this page Jul 4, 2024 · 32 revisions

Welcome to the yocto-metrics wiki!

CVE patch: Contributing through mailing lists

📣 Please read this for creating a CVE patch: See Yocto Contributing guides

Creating patches and sending them

  • git commit -s The -s option of git commit adds a “Signed-off-by:” line to your commit message.

  • git branch --edit-description // better use a branchname here but this didn't work

  • git format-patch --subject-prefix='master][PATCH' --cover-letter --cover-from-description=auto <COMMIT>

you can add -s tag after format-patch if you did not add sign-off when making the commits. For yocto project we need to add sign-off

Instead of *.patch you can specify patch file names. For --to and --cc options, repeat for each user you want on the to/cc list.

Note: For git email configurations, please use your thehoodiefirm.com email for smtpuser and create gmail app password for smtppass (make sure you have 2 factor verification set up for this to work). Remove all spaces for the generated app password. Yocto guideline on email setup is here.

Responding to change requests

  • git commit -s: Commit the new changes to the code
  • git format-patch -v2 -1 COMMIT_NUMBER: Add commit number which contains the new changes. If there are multiple commits, remove the -1. This will create patch files for all the commits ahead of the mentioned number. Also note v2 indicates the number of versions or iterations of your changes. In this example it is the second version, you can change the number accordingly.
  • git send-email --to MAILING_LIST_EMAIL --in-reply-to MESSAGE_ID --cc [email protected] --reply-to [email protected] *.patch The message ID in Gmail can be found by clicking on the specific email you want to reply to and clicking on 'Show original'. Make sure to add anyone (by --cc or --to) who may have commented on the patch from the mailing list to keep them in the loop.

For larger patch series it is preferable to send a pull request that not only includes the patch but also a pointer to a branch that can be pulled from.

Documentation on contributing to yocto: https://docs.yoctoproject.org/contributor-guide/submit-changes.html#using-scripts-to-push-a-change-upstream-and-request-a-pull

The following namespaces have push access to the yocto-metrics and yocto-autobuilder-helper repo:

  • contrib/albaherrerias/*
  • contrib/ninette/*
  • contrib/jacobabrandner/*

Pushing commit to remote repo

Go to the relevant local repository and push your commit in the following format:

git push [email protected]:REPO_NAME LOCAL_BRANCH:NAMESPACE/BRANCH_NAME

For yocto-metrics for example, the command will be like this:

git push [email protected]:yocto-metrics patch-status-improvements-contrib:contrib/ninette/patch-status-improvements-contrib

Create and share Pull request

After committing changes to the remote repo, you can create Pull request patch files with the following:

LOCAL_PATH/poky/scripts/create-pull-request -u REMOTE_REPO -s "PR_TITLE"

For example for yocto-metrics it will be like this:

~/poky/scripts/create-pull-request -u https://git.yoctoproject.org/yocto-metrics/ -s "M10: Metrics view"

The patch files can be emailed to yocto team through their mailing list or internally through NH sales team.

Generate CVE report

Setting up Metrics view report

Links

Setup

Clone repo

Clone both the report and data repo:

# clone yocto-autobuilder-helper from Neighbourhoodie fork
git clone https://github.com/neighbourhoodie/yocto-autobuilder-helper.git

# clone yocto-metrics from Neighbourhoodie fork
git clone https://github.com/neighbourhoodie/yocto-metrics.git

Generate chart data

At first we have to generate the necessary data for the charts. For this we have to go the autobuilder repo and generate chart data.

# Go to your local clone of the autobuilder repo
cd yocto-autobuilder-helper

Patch metrics data

Make sure to add your local path to the yocto-metrics repo.

# Then run the following to generate the data and save it in your local yocto-metrics repo
./scripts/patchmetrics-generate-chartdata --json "YOUR_LOCAL_PATH/yocto-metrics/patch-status.json" --outputdir "YOUR_LOCAL_PATH/yocto-metrics/patch-status/"

CVE chart data

Next you'll need to generate CVE chart data by running the following. Again please note to add your local path to the yocto-metrics repo.

./scripts/cve-generate-chartdata --json "YOUR_LOCAL_PATH/yocto-metrics/cve-count-byday.json" --resultsdir "YOUR_LOCAL_PATH/yocto-metrics/cve-check/"

CVE report data

The following is for generating CVE report data. Note that CVE data needs to be generated for each branch. The following is an example showing data generated for the master branch. You will need to run this for every branch you need CVE data for.

📣 Replace master for other relevant branch names and 1709622082 for respective json file names. The branch names and data are listed here.

./scripts/cve-report.py "YOUR_LOCAL_PATH/yocto-metrics/cve-check/master/<TIMESTAMP>.json" > "YOUR_LOCAL_PATH/yocto-metrics/patch-status/cve-status-master.json"

For Jacoba it is

./scripts/cve-report.py "../yocto-metrics/cve-check/master/1709622082.json" > "../yocto-metrics/patch-status/cve-status-master.txt"
./scripts/cve-report.py "../yocto-metrics/cve-check/dunfell/1712037647.json" > "../yocto-metrics/patch-status/cve-status-dunfell.txt"
./scripts/cve-report.py "../yocto-metrics/cve-check/kirkstone/1712038549.json" > "../yocto-metrics/patch-status/cve-status-kirkstone.txt"
./scripts/cve-report.py "../yocto-metrics/cve-check/nanbield/1712040349.json" > "../yocto-metrics/patch-status/cve-status-nanbield.txt"

View chart

Once the chart data is created you can run the chart html files in the yocto-metrics repo as follows:

# Go to your local clone of the yocto-metrics repo
cd yocto-metrics

# open the chart html file in your browser
open ./patch-status/index.html

Note: If the index.html throws CORS error you can run the file through VSCode's Live Server.

Clone this wiki locally