From 552bf40db16505e1549f149b095d47e98da29594 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 18 Sep 2026 11:11:41 +0200 Subject: [PATCH] utils/checkpackagelib: support other identifiers than CVE Currently the MissingCVEPatch check will complain if another identifiers than a CVE-YYYY-XXXX is passed after the 'CVE: ' trailer in the patch header introduced in [1]. If a package 'foo' defines the following: FOO_IGNORE_CVES += GHSA-abcd-1234-efgh And correctly references it in a patch header: CVE: GHSA-abcd-1234-efgh check-package will report the following: package/foo/foo.mk: patch file '0001-some-patch.patch' is missing 'CVE:' tag While we could argue that GHSA identifier should not be present in the 'IGNORE_CVES' variable, it's still valuable for users to have a way to correctly ignore and link a patch for their vulnerability report. From our point of view it allows us to track GHSA vulnerabilities that could later be assigned a CVE so we can update the IGNORE_CVES variable. This commit relaxes the constraint on the 'CVE' trailer to just check for the presence of any identifier. We still only allow alphanumerical characters and dashes, to be sure that any tooling that uses the identifiers won't break. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale [Arnout: - keep the regex but allow any alphanumerical string; - add a test that FOO:123 doesn't match] Signed-off-by: Arnout Vandecappelle --- utils/checkpackagelib/lib_mk.py | 2 +- utils/checkpackagelib/test_lib_mk.py | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/utils/checkpackagelib/lib_mk.py b/utils/checkpackagelib/lib_mk.py index 065733d464..1fa056cbf4 100644 --- a/utils/checkpackagelib/lib_mk.py +++ b/utils/checkpackagelib/lib_mk.py @@ -121,7 +121,7 @@ class Indent(_CheckFunction): class MissingCVEPatch(_CheckFunction): PATCH_COMMENT = re.compile(r"^#\s*(\S+\.patch)\s*$") IGNORE_CVES = re.compile(r"^[A-Z0-9_]+_IGNORE_CVES\s*\+?=") - CVE_TAG_IN_PATCH = re.compile(r"^CVE: *CVE-\d+-\d+$") + CVE_TAG_IN_PATCH = re.compile(r"^CVE: *([\w-]+)$") def before(self): self.pending_patches = [] diff --git a/utils/checkpackagelib/test_lib_mk.py b/utils/checkpackagelib/test_lib_mk.py index 21effa9489..9d2950ef79 100644 --- a/utils/checkpackagelib/test_lib_mk.py +++ b/utils/checkpackagelib/test_lib_mk.py @@ -239,6 +239,17 @@ MissingCVEPatch = [ {}, 'FOO_IGNORE_CVES += CVE-2000-1234\n', []), + ('invalid syntax in patch', + {'0001-some-fix.patch': 'CVE: FOO:123'}, + '# 0001-some-fix.patch\n' + 'FOO_IGNORE_CVES += FOO:123\n', + [['{}: patch file \'0001-some-fix.patch\' is missing \'CVE:\' tag', + '# 0001-some-fix.patch\n']]), + ('patches present with other identifier', + {'0001-some-fix.patch': 'CVE: GHSA-abcd-1234-efgh'}, + '# 0001-some-fix.patch\n' + 'FOO_IGNORE_CVES += GHSA-abcd-1234-efgh\n', + []), ]