Backport 2 patches to fix the build error: Processing fix.text for: java_jre_configure_crypto_policy rule Unable to extract part of the fix.text after inclusion of remediation functions. Aborting.. jre/CMakeFiles/generate-internal-jre-bash-fixes.xml.dir/build.make:60: recipe for target 'jre/bash-fixes.xml' failed make[2]: *** [jre/bash-fixes.xml] Error 1 make[2]: *** Deleting file 'jre/bash-fixes.xml'
Signed-off-by: Yi Zhao <[email protected]> --- ...ng-of-the-remediation-functions-file.patch | 39 +++++++++++++++++++ ...-fix-when-greedy-regex-ate-the-whole.patch | 35 +++++++++++++++++ .../scap-security-guide_git.bb | 5 ++- 3 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch create mode 100644 meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch new file mode 100644 index 0000000..c0b93e4 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch @@ -0,0 +1,39 @@ +From 174293162e5840684d967e36840fc1f9f57c90be Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <[email protected]> +Date: Thu, 5 Dec 2019 15:02:05 +0100 +Subject: [PATCH] Fix XML "parsing" of the remediation functions file. + +A proper fix is not worth the effort, as we aim to kill shared Bash remediation +with Jinja2 macros. + +Upstream-Status: Backport +[https://github.com/ComplianceAsCode/content/commit/174293162e5840684d967e36840fc1f9f57c90be] + +Signed-off-by: Yi Zhao <[email protected]> +--- + ssg/build_remediations.py | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py +index 7da807bd6..13e90f732 100644 +--- a/ssg/build_remediations.py ++++ b/ssg/build_remediations.py +@@ -56,11 +56,11 @@ def get_available_functions(build_dir): + remediation_functions = [] + with codecs.open(xmlfilepath, "r", encoding="utf-8") as xmlfile: + filestring = xmlfile.read() +- # This regex looks implementation dependent but we can rely on +- # ElementTree sorting XML attrs alphabetically. Hidden is guaranteed +- # to be the first attr and ID is guaranteed to be second. ++ # This regex looks implementation dependent but we can rely on the element attributes ++ # being present on one line. ++ # We can't rely on ElementTree sorting XML attrs in any way since Python 3.7. + remediation_functions = re.findall( +- r'<Value hidden=\"true\" id=\"function_(\S+)\"', ++ r'<Value.*id=\"function_(\S+)\"', + filestring, re.DOTALL + ) + +-- +2.17.1 + diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch new file mode 100644 index 0000000..f0c9909 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch @@ -0,0 +1,35 @@ +From 28a35d63a0cc6b7beb51c77d93bb30778e6960cd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <[email protected]> +Date: Mon, 9 Dec 2019 13:41:47 +0100 +Subject: [PATCH] Fixed the broken fix, when greedy regex ate the whole file. + +We want to match attributes in an XML element, not in the whole file. + +Upstream-Status: Backport +[https://github.com/ComplianceAsCode/content/commit/28a35d63a0cc6b7beb51c77d93bb30778e6960cd] + +Signed-off-by: Yi Zhao <[email protected]> +--- + ssg/build_remediations.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py +index 13e90f732..edf31c0cf 100644 +--- a/ssg/build_remediations.py ++++ b/ssg/build_remediations.py +@@ -57,10 +57,10 @@ def get_available_functions(build_dir): + with codecs.open(xmlfilepath, "r", encoding="utf-8") as xmlfile: + filestring = xmlfile.read() + # This regex looks implementation dependent but we can rely on the element attributes +- # being present on one line. ++ # being present. Beware, DOTALL means we go through the whole file at once. + # We can't rely on ElementTree sorting XML attrs in any way since Python 3.7. + remediation_functions = re.findall( +- r'<Value.*id=\"function_(\S+)\"', ++ r'<Value[^>]+id=\"function_(\S+)\"', + filestring, re.DOTALL + ) + +-- +2.17.1 + diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb index d9238c0..f35d769 100644 --- a/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb @@ -1,7 +1,10 @@ SUMARRY = "SCAP content for various platforms, OE changes" SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed" -SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44;" +SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44; \ + file://0001-Fix-XML-parsing-of-the-remediation-functions-file.patch \ + file://0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch \ + " PV = "0.1.44+git${SRCPV}" require scap-security-guide.inc -- 2.17.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#48298): https://lists.yoctoproject.org/g/yocto/message/48298 Mute This Topic: https://lists.yoctoproject.org/mt/71052561/21656 Group Owner: [email protected] Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
