mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-23 09:22:21 -09:00
Code Issues Packages Projects Releases Wiki Activity

utils/checkpackagelib: support other identifiers than CVE

Browse Source 
Currently the MissingCVEPatch check will complain if another
identifiers than a CVE-YYYY-XXXX is passed after the 'CVE: '
trailer in the patch header introduced in [1].

If a package 'foo' defines the following:

FOO_IGNORE_CVES += GHSA-abcd-1234-efgh

And correctly references it in a patch header:

CVE: GHSA-abcd-1234-efgh

check-package will report the following:

package/foo/foo.mk: patch file '0001-some-patch.patch' is missing 'CVE:' tag

While we could argue that GHSA identifier should not be present in the
'IGNORE_CVES' variable, it's still valuable for users to have a way to
correctly ignore and link a patch for their vulnerability report.

From our point of view it allows us to track GHSA vulnerabilities that
could later be assigned a CVE so we can update the IGNORE_CVES variable.

This commit relaxes the constraint on the 'CVE' trailer to just check
for the presence of any identifier. We still only allow alphanumerical
characters and dashes, to be sure that any tooling that uses the
identifiers won't break.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
 - keep the regex but allow any alphanumerical string;
 - add a test that FOO:123 doesn't match]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This commit is contained in:
Thomas Perale
2026-09-18 11:11:41 +02:00
committed by Arnout Vandecappelle
parent 3ac595bdd1
commit 552bf40db1
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
utils/checkpackagelib/lib_mk.py
View File

@@ -121,7 +121,7 @@ class Indent(_CheckFunction):
class MissingCVEPatch(_CheckFunction):
PATCH_COMMENT = re.compile(r"^#\s*(\S+\.patch)\s*$")
IGNORE_CVES = re.compile(r"^[A-Z0-9_]+_IGNORE_CVES\s*\+?=")
CVE_TAG_IN_PATCH = re.compile(r"^CVE: *CVE-\d+-\d+$")
CVE_TAG_IN_PATCH = re.compile(r"^CVE: *([\w-]+)$")
def before(self):
self.pending_patches = []

11
utils/checkpackagelib/test_lib_mk.py
View File

@@ -239,6 +239,17 @@ MissingCVEPatch = [
{},
'FOO_IGNORE_CVES += CVE-2000-1234\n',
[]),
('invalid syntax in patch',
{'0001-some-fix.patch': 'CVE: FOO:123'},
'# 0001-some-fix.patch\n'
'FOO_IGNORE_CVES += FOO:123\n',
[['{}: patch file \'0001-some-fix.patch\' is missing \'CVE:\' tag',
'# 0001-some-fix.patch\n']]),
('patches present with other identifier',
{'0001-some-fix.patch': 'CVE: GHSA-abcd-1234-efgh'},
'# 0001-some-fix.patch\n'
'FOO_IGNORE_CVES += GHSA-abcd-1234-efgh\n',
[]),
]