yocto-security-tools

Standalone CVE management tools for Yocto/OpenEmbedded Linux distributions.

Tools

Requirements

• Python 3.9+
• Git
• For cve-corrector / cve-agent: a sourced Yocto build environment (BBPATH set)
• For cve-agent: an AI backend — kiro-cli (default) or Claude Code (--backend claude), or a custom backend plugin
• Optional, for cve-agent: patchutils (provides interdiff) — when installed, cve-agent enriches its review diff, console output, and AI context with a concise upstream-vs-backport adaptation delta. When absent, cve-agent falls back to its existing behavior unchanged.

Installation

From PyPI

pip install yocto-security-tools

From source (development)

git clone https://github.com/Ericsson/yocto-security-tools.git
cd yocto-security-tools
pip install -e .

Quick Start

Find CVE fix metadata

# From Yocto cve-summary.json (output of sbom-cve-check)
cve-metadata-extractor --yocto-summary cve-summary.json --output cve-metadata.json

# For a specific CVE
cve-metadata-extractor --cve-id CVE-2024-1234 --cve-component-name openssl

Apply CVE patches

# Source your Yocto build environment first
source oe-init-build-env

# Apply a CVE fix
cve-corrector --cve-id CVE-2024-1234 --cve-info cve-metadata.json

# Resume after manual conflict resolution
cve-corrector --continue

Dependent commit chains. --fix-url is repeatable. A single URL applies one fix commit (or one pull request's commits); two or more URLs are treated as one ordered, dependent chain — the caller controls the order, and all commits must apply or the run stops at a conflict (no falling back to applying just one of them). Use this when a CVE is fixed by a short series of follow-up commits on the same branch, e.g. acl's CVE-2026-XXXXX:

cve-corrector --cve-id CVE-2026-XXXXX --recipe acl \
  --fix-url https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=5906d2868ec8d3b08be556153696e6b1122eeeda \
  --fix-url https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=0071c6d1fea0a8a6270333baa85fb609be325c26 \
  --fix-url https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=170dbd3beff9bd5bdab3f72db1a04bf282f6087c

If the chain conflicts partway through, resolve it and resume with cve-corrector --continue — the remaining commits are applied in the same order. cve-agent accepts the same repeated --fix-url flag and forwards it unchanged to cve-corrector.

AI-assisted backporting

# Requires an AI backend CLI: kiro-cli (default) or Claude Code
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --trust

# Batch mode
cve-agent --cve-list cves.txt --cve-info cve-metadata.json --trust

# Use the Claude Code backend (install and authenticate the `claude` CLI first)
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --backend claude --model sonnet

# Use a custom backend plugin from extra/
cve-agent --cve-id CVE-2024-1234 --cve-info cve-metadata.json --backend my_backend

AI backends. kiro (default) drives kiro-cli; claude drives the Claude Code claude CLI directly. The Claude Code backend needs a recent claude on PATH, already authenticated (Anthropic API key, or Bedrock/Vertex), supporting -p, --permission-mode, --allowedTools/--disallowedTools, --append-system-prompt, and --add-dir. Pass --model sonnet|opus|haiku (or a full model id); the default claude-sonnet-5 is mapped to sonnet. Both backends run under the same file-scope guard, so the AI can only modify the files the upstream fix touches.

How It Works

graph LR
    E["cve-metadata-extractor<br/>Find fix commits"] -->|cve-metadata.json| C["cve-corrector<br/>Apply patches via devtool"]
    C -->|exit code + state| A["cve-agent<br/>AI-assisted resolution"]
    A -->|subprocess| C

Each tool works independently. Chain them via --cve-info cve-metadata.json.

Supported Input Formats

Configuration

The extractor reads configuration from cve_metadata_extractor/config.json by default. Override with the CVE_EXTRACTOR_CONFIG environment variable.

Storage (XDG Compliant)

Config Keys

Environment Variables

Plugin System

Add custom CVE data sources or AI backends by dropping .py files in the extra/ directory. See extra/README.md for the plugin development guide.

Quick Example: Custom Source

# extra/my_source.py
from cve_metadata_extractor.sources import CveSource, SOURCE_REGISTRY

class MySource(CveSource):
    name = 'my_source'
    def is_enabled(self, args): return True
    def extract(self, cve_id, stats): return [], [], [], []

SOURCE_REGISTRY.append(MySource())

Development

python3 -m venv venv
source venv/bin/activate
pip install -e ".[dev]"
pytest

See CONTRIBUTING.md for full development guidelines.

License

MIT — see LICENSE