natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-4.1' into cassandra-5.0 

* cassandra-4.1:
  ninja-fix – python2 compat on .build/generate-snyk-file
This commit is contained in:
Mick Semb Wever 2025-03-30 14:02:47 +02:00
parent 1311766ad1 5baedef1d0
commit 11eb601352
No known key found for this signature in database
GPG Key ID: E91335D77E3E87CB
3 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.build/docker/_build-redhat.sh
View File

@ -114,6 +114,7 @@ cp ${DIST_DIR}/apache-cassandra-*-src.tar.gz ${RPM_BUILD_DIR}/SOURCES/
# if CASSANDRA_VERSION is -alphaN, -betaN, -rcN, then rpmbuild fails on the '-' char; replace with '~'
CASSANDRA_VERSION=${CASSANDRA_VERSION/-/\~}
CASSANDRA_REVISION=${CASSANDRA_REVISION/-/_}
command -v python >/dev/null 2>&1 || alias python=/usr/bin/python3
rpmbuild --define="version ${CASSANDRA_VERSION}" --define="revision ${CASSANDRA_REVISION}" --define="_topdir ${RPM_BUILD_DIR}" -ba ${RPM_SPEC}

2
.build/generate-snyk-file
View File

@ -68,7 +68,7 @@ with open(os.path.join(script_dir, "../.snyk"), "w") as snyk_file:
snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n")
snyk_file.write("version: v1.25.0\n")
snyk_file.write(f"ignore:\n")
for cve_id, ignores in snyk_data["ignore"].items():
for cve_id, ignores in sorted(snyk_data["ignore"].items()):
snyk_file.write(f" {cve_id}:\n")
for ignore in ignores:
snyk_file.write(f" - reason: {ignore['reason']}\n")

8
.snyk
View File

@ -16,17 +16,21 @@ ignore:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-41854:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2023-44487:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2022-42003:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2022-42004:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2023-35116:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2023-44487:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2023-6378:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2023-6481:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12798:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12801:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-45772:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20024 -- ^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$