From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from cyan.elm.relay.mailchannels.net (cyan.elm.relay.mailchannels.net [23.83.212.47]) by sourceware.org (Postfix) with ESMTPS id 29729385840F for ; Mon, 29 Jan 2024 13:56:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 29729385840F Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=sourceware.org Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=sourceware.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 29729385840F Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.212.47 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706536563; cv=pass; b=XwkZQ57L/hdOirls37/f9cx4PLHhu4GSWAN6jCkV9fNcuPzMo7BrjNjhtht3EgB4i8wuq/CFDkQz42arwP4lfaAuf83D+WPtLx7l0J2tokB4bDNU0DQXO2LtlndTVIUrHxb7TQxUAEamaquSd7UqGfGnP1bjBgFJWQLhDp5wA44= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706536563; c=relaxed/simple; bh=53zCiHS4xgy9zZi6y41nbLUSvF6xGpOvmzvdVeFcL5c=; h=Message-ID:Date:MIME-Version:Subject:To:From; b=NMclwr7s2VX95mMswV1f4apSrlgwxVrOPGSO8zD2uPRLELIUiIs6WudfFBtg4D6qQvH2OsbwuuAYlLC9vUMpatqbmvGTZi2UgHYWZ5sdPkLZrrZ80KS9au0TWcErXIA4OiD7Nc9IsMtM/ecc/MEtl9Ixpo3MJyAB0KMmd3TYXjU= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 1C8827625CB; Mon, 29 Jan 2024 13:56:00 +0000 (UTC) Received: from pdx1-sub0-mail-a261.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 4937D76259D; Mon, 29 Jan 2024 13:55:58 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1706536558; a=rsa-sha256; cv=none; b=uwY6fJ2+tJyBnfKV9vZdKIGcKEdxzugZwTfYbVx97fUAgb5hmiAYkTmR1XLu8bic3RCmXh ZZLg+kNwjpFCLA8VAmKhynHI9zOsao1lOg78qtuneDbSWu99mNEd66Cy5L6KhTk5THURFl wsacH3awAJNU5vXgfHH9nG6h/yo8oD8obf0OspFLwE2FewcAt9guIbqWhT3ZHNgllhftw8 4jQ7W+yuysOuY0W5lQuAXSzk62z8V56QflZXpRvMdA7U5Tpf5PdIm+ckmX7NAFE2VZEA15 phRsT1x0N1x212IqShomaTwkNxyk70jw9b+Wwf3zMvli6u4v8Mlvu/TxhSUDZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1706536558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kPV6MxMWuGgwi0kywxApd4dAx+k4w/W1oM5nHn7I2MU=; b=mqj5rdIp73i+cwyTj03tj0y3sRpl5iwZx0At9QlneX4pO+MjqHB7dGkwBKspiYmkFYZjmv 9bbd5lkIFxxzu/qW14IXXX8DI/j9UOzT5jbhXyCk3XUl7y6ZBjNr6I9O8IYFFT2tAh+jvn uoSCNdZzvK7YS+Sgyd6J6QuEFgXJl1TsmX4+Z+pHg5i6/D+Q+1dtUoQ0L0ucuSowWMUteh jlob/U/C0NM0e7z95Aoeszs+ev/MkNucGlqyhGb36i9R/ZPjBjEj+idKhk33bb7N0GkUFp WF5zBprBG1ck3y7xcfPHSV/hyjyYLRLaUpA1AGFa032zdGaijaurripVWElKCA== ARC-Authentication-Results: i=1; rspamd-9c9494d96-8sz68; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Arithmetic-Arch: 31604e14499134b9_1706536558703_1604482317 X-MC-Loop-Signature: 1706536558703:2911789175 X-MC-Ingress-Time: 1706536558703 Received: from pdx1-sub0-mail-a261.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.100.20.137 (trex/6.9.2); Mon, 29 Jan 2024 13:55:58 +0000 Received: from [192.168.0.182] (bras-base-toroon4834w-grc-23-76-68-24-30.dsl.bell.ca [76.68.24.30]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a261.dreamhost.com (Postfix) with ESMTPSA id 4TNqZj4gDfz7v; Mon, 29 Jan 2024 05:55:57 -0800 (PST) Message-ID: <274eab97-9ddb-4471-8ec6-e0d65945d646@sourceware.org> Date: Mon, 29 Jan 2024 08:55:53 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] Update advisory format and introduce some automation Content-Language: en-US To: "Andreas K. Huettel" , libc-alpha@sourceware.org Cc: carlos@redhat.com, adhemerval.zanella@linaro.org, fweimer@redhat.com References: <20240124195830.137143-1-siddhesh@sourceware.org> <20240124200204.137436-1-siddhesh@sourceware.org> <1799412.TLkxdtWsSY@pinacolada> From: Siddhesh Poyarekar In-Reply-To: <1799412.TLkxdtWsSY@pinacolada> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1165.7 required=5.0 tests=BAYES_00,KAM_DMARC_NONE,KAM_DMARC_STATUS,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_SOFTFAIL,TXREP,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 2024-01-27 18:54, Andreas K. Huettel wrote: > Am Mittwoch, 24. Januar 2024, 21:02:04 CET schrieb Siddhesh Poyarekar: >> Simplify the advisory format by dropping the -Backport tags and instead >> stick to using just the -Commit tags. To identify backports, put a >> substring of git-describe into the release version in the brackets next >> to the commit ref. This way, it not only identifies that the fix (or >> regression) is on the release/2.YY/master branch, it also disambiguates >> regressions/fixes in the branch from those in the tarball. >> >> Add a README to make it easier for consumers to understand the format. >> Additionally, the Release wiki needs to be updated to inform the release >> manager to: >> >> 1. Generate a NEWS snipped from the advisories directory >> >> AND >> >> 2. on release/2.YY/master, replace the advisories directory with a text >> file pointing to the advisories directory in master so that we don't >> have to update multiple locations. >> >> Signed-off-by: Siddhesh Poyarekar >> --- >> > > Some minor things below, otherwise good to go and > > Reviewed-by: Andreas K. Hüttel Thanks! I'm sending out a v3 with your suggested changes. > > >> + >> + Tag-name: (release-version) >> + >> +The indicates a specific commit in the repository. The >> +release-version indicates the publicly consumable release in which this >> +commit is known to exist. For a simple release-version, e.g. 2.34, this >> +change is present in release tarballs. For release-version of the form >> +2.34-NNN (e.g. 2.34-42), the change is on the release/2.34/master >> +branch and not in any released tarball. > > Since this follows git-describe, I assume it means the 42th commit on the > branch after the tag... Why not write that here? Ack, will do. >> +Adding an Advisory >> +------------------ >> + >> +An advisory for a CVE needs to be added in two steps: >> + >> +1. > > On the master branch, ... OK. > >> Add the text of the advisory without any Fix-Commit tags along with >> + the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. >> + The advisories directory does not exist in > > ... release ... OK. >> branches, so keep the >> + advisory text commit distinct from the code changes, to ease >> + backports. Ask for the GLIBC-SA advisory number from the security >> + team. >> + > >> +2. Finish all backports > > ... on release branches ... OK. >> and then add all commits to the advisory > > ... on the master branch ... OK, I've reworded it a bit. >> using >> + the Fix-Commit tags. Don't add the release-version subscript. >> + >> +3. Run the process-advisories.sh script in the scripts directory on the >> + advisory: > > [...] > >> + >> +advisories_news() { >> + rel=$(get_rel "HEAD") >> + for f in $(grep -l "^Fix-Commit: .* ($rel)$" advisories/*); do >> + echo -e " $(basename $f):" >> + cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f) > > ^ This assumes that every SA will ever have exactly one CVE. > Is that a safe assumption? Yes, we'll maintain a 1:1 correspondence between GLIBC-SA- and CVE-. >> + echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | >> + while read line; do >> + echo " $line" >> + done >> + echo >> + done Thanks, Sid