yocto-security-tools

Standalone CVE management tools for Yocto/OpenEmbedded Linux distributions.

Tools

Requirements

• Python 3.9+
• Git
• For cve-corrector / cve-agent: a sourced Yocto build environment (BBPATH set)
• For cve-agent: an AI backend — kiro-cli (default) or Claude Code (--backend claude), or a custom backend plugin

Installation

From PyPI

pip install yocto-security-tools

From source (development)

git clone https://github.com/Ericsson/yocto-security-tools.git
cd yocto-security-tools
pip install -e .

Quick Start

Find CVE fix metadata

# From Yocto cve-summary.json (output of sbom-cve-check)
cve-metadata-extractor --yocto-summary cve-summary.json --output cve-metadata.json

# For a specific CVE
cve-metadata-extractor --cve-id CVE-2024-1234 --cve-component-name openssl

Apply CVE patches

# Source your Yocto build environment first
source oe-init-build-env

# Apply a CVE fix
cve-corrector --cve-id CVE-2024-1234 --cve-info cve-metadata.json

# Resume after manual conflict resolution
cve-corrector --continue

AI-assisted backporting

# Requires an AI backend CLI: kiro-cli (default) or Claude Code
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --trust

# Batch mode
cve-agent --cve-list cves.txt --cve-info cve-metadata.json --trust

# Use the Claude Code backend (install and authenticate the `claude` CLI first)
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --backend claude --model sonnet

# Use a custom backend plugin from extra/
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --backend my_backend

AI backends. kiro (default) drives kiro-cli; claude drives the Claude Code claude CLI directly. The Claude Code backend needs a recent claude on PATH, already authenticated (Anthropic API key, or Bedrock/Vertex), supporting -p, --permission-mode, --allowedTools/--disallowedTools, --append-system-prompt, and --add-dir. Pass --model sonnet|opus|haiku (or a full model id); the default claude-sonnet-4.6 is mapped to sonnet. Both backends run under the same file-scope guard, so the AI can only modify the files the upstream fix touches.

How It Works

graph LR
    E["cve-metadata-extractor<br/>Find fix commits"] -->|cve-metadata.json| C["cve-corrector<br/>Apply patches via devtool"]
    C -->|exit code + state| A["cve-agent<br/>AI-assisted resolution"]
    A -->|subprocess| C

Each tool works independently. Chain them via --cve-info cve-metadata.json.

Supported Input Formats

Configuration

The extractor reads configuration from cve_metadata_extractor/config.json by default. Override with the CVE_EXTRACTOR_CONFIG environment variable.

Storage (XDG Compliant)

Config Keys

Environment Variables

Plugin System

Add custom CVE data sources or AI backends by dropping .py files in the extra/ directory. See extra/README.md for the plugin development guide.

Quick Example: Custom Source

# extra/my_source.py
from cve_metadata_extractor.sources import CveSource, SOURCE_REGISTRY

class MySource(CveSource):
    name = 'my_source'
    def is_enabled(self, args): return True
    def extract(self, cve_id, stats): return [], [], [], []

SOURCE_REGISTRY.append(MySource())

Development

python3 -m venv venv
source venv/bin/activate
pip install -e ".[dev]"
pytest

See CONTRIBUTING.md for full development guidelines.

License

MIT — see LICENSE