From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bisque.elm.relay.mailchannels.net (bisque.elm.relay.mailchannels.net [23.83.212.18]) by sourceware.org (Postfix) with ESMTPS id 5B4E438582B9 for ; Tue, 30 Jan 2024 19:00:46 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 5B4E438582B9 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=sourceware.org Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=sourceware.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 5B4E438582B9 Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.212.18 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706641249; cv=pass; b=Tz5Fir49PhAmmYRdA1jeS/lfxLz+P1EYvO0CJ4BebJ4a+6bgET72PAkacQ5lh4j6gundTlyEFOYuUWQHKS4fojJkVMuxDjpmbtLgTqB7ebaMRbi8VIcHbQwYGALncx3cQolDqRLXLijpgFFh7pbZWCpfJL3AOwduTt0Zi0QRIXQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1706641249; c=relaxed/simple; bh=stvqBHYymnosBoY1xZJr3VbDEQ9V4MKujCzeK5FD3Vc=; h=Message-ID:Date:MIME-Version:Subject:From:To; b=vsj33uXFIIfIIZgXqJCebcd02RyfOS/ShxEQkvGSfT8Ao2iRLiI/e5z34LSQE5AuwknBCISuddt6MfFl9IzkUbv2Pp38COh4iKIFAWtSABsXEpFBZZ+fDVrKGfHuMJM911S1Wzk2IsrTKu2NTgiaPA7d8T0FVUasPKcLJptAdi4= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 3AB3C8022D3; Tue, 30 Jan 2024 19:00:44 +0000 (UTC) Received: from pdx1-sub0-mail-a241.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id A7F98803B49; Tue, 30 Jan 2024 19:00:43 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1706641243; a=rsa-sha256; cv=none; b=SQMR0C0EeEBGPdiL2i0Ci3o/EXR2hDisuZWZtfdcal1Kf/YjrwJ4jHZUoDedwazBcWnv/1 OqDeseZnuNETj8n1fjgAKWYHKhUud0hzNQhGHidjVR8QKb758e21wXUvDlnpKbWeR4cHu+ USZuDUhqaOSeHZzQ6bBLKKKV6Ggu7XGllkSXBIfPwaICtny0vxCrBH/PG13qM9TlbY+ese 0gYlhN4EX3mIjfFaV4UCR6lHd8UseKZ89YtGgPzE84DBzG8jooQBck1pNzNuw5S/Z2QxEH uqF17LFesZ4KVUap1O9eY1XdEBpOmdtIsu9dAkzOwYQQ/iTyP1rbShrwqUIYdA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1706641243; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sXjfVtwfMJtusopkuKIZ9IwOzlTqW8M1Io40xSBz+d0=; b=rVunAcXs3HLce8eJkwcvodUC9JEv9iIFEDstpWUahQQML+HgVzLKMmtg9PagF2A2fPHGqB 2UP1qVHjWDvOweALHx/borS9j0aDe9kbSuD1ps4DStqSnPcvH5Qd2A+ncqCbAX69dysHhm MjyfNqmmGkq3rK3bN3QH7VnF67jL8EPcJIn2F02EhweErQBsugArO/SlutcfRohzHd3wKK snJxCY5nEALjjjevytEIp+HMFq704hlJMTr4F8Hvh4mwhSPaQuGrkM4hwx8SXlpCBLOlyP SWincoahoaLkiZFW8A/6IWxg356DZDtUYc8UQUm6babGqyVD1BA4/baUIqs9JA== ARC-Authentication-Results: i=1; rspamd-55dc85bb6f-rp52r; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Trade-Whimsical: 007ed4cf456c289f_1706641243974_565899031 X-MC-Loop-Signature: 1706641243974:3966592023 X-MC-Ingress-Time: 1706641243974 Received: from pdx1-sub0-mail-a241.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.109.86.202 (trex/6.9.2); Tue, 30 Jan 2024 19:00:43 +0000 Received: from [192.168.0.182] (bras-base-toroon4834w-grc-23-76-68-24-30.dsl.bell.ca [76.68.24.30]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a241.dreamhost.com (Postfix) with ESMTPSA id 4TPZHv0sKJz2b; Tue, 30 Jan 2024 11:00:43 -0800 (PST) Message-ID: Date: Tue, 30 Jan 2024 14:00:32 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3] Update advisory format and introduce some automation Content-Language: en-US From: Siddhesh Poyarekar To: libc-alpha@sourceware.org Cc: carlos@redhat.com, adhemerval.zanella@linaro.org, fweimer@redhat.com, dilfridge@gentoo.org References: <20240124195830.137143-1-siddhesh@sourceware.org> <20240129135620.491654-1-siddhesh@sourceware.org> In-Reply-To: <20240129135620.491654-1-siddhesh@sourceware.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-1171.5 required=5.0 tests=BAYES_00,GIT_PATCH_0,KAM_DMARC_NONE,KAM_DMARC_STATUS,KAM_LOTSOFHASH,KAM_SHORT,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_SOFTFAIL,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Pushed with your R-b now Andreas. Thanks, Sid On 2024-01-29 08:56, Siddhesh Poyarekar wrote: > Simplify the advisory format by dropping the -Backport tags and instead > stick to using just the -Commit tags. To identify backports, put a > substring of git-describe into the release version in the brackets next > to the commit ref. This way, it not only identifies that the fix (or > regression) is on the release/2.YY/master branch, it also disambiguates > regressions/fixes in the branch from those in the tarball. > > Add a README to make it easier for consumers to understand the format. > Additionally, the Release wiki needs to be updated to inform the release > manager to: > > 1. Generate a NEWS snipped from the advisories directory > > AND > > 2. on release/2.YY/master, replace the advisories directory with a text > file pointing to the advisories directory in master so that we don't > have to update multiple locations. > > Signed-off-by: Siddhesh Poyarekar > --- > Changes from v2: > - Fixed suggestions from Andreas. > > advisories/GLIBC-SA-2023-0001 | 2 +- > advisories/GLIBC-SA-2023-0002 | 6 +-- > advisories/GLIBC-SA-2023-0003 | 10 ++--- > advisories/GLIBC-SA-2023-0004 | 10 ++--- > advisories/GLIBC-SA-2023-0005 | 22 +++++---- > advisories/README | 73 ++++++++++++++++++++++++++++++ > scripts/process-advisories.sh | 85 +++++++++++++++++++++++++++++++++++ > scripts/process-fixed-cves.sh | 41 ----------------- > 8 files changed, 182 insertions(+), 67 deletions(-) > create mode 100644 advisories/README > create mode 100755 scripts/process-advisories.sh > delete mode 100755 scripts/process-fixed-cves.sh > > diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 > index 12b4f8edb8..3d19c91b6a 100644 > --- a/advisories/GLIBC-SA-2023-0001 > +++ b/advisories/GLIBC-SA-2023-0001 > @@ -11,4 +11,4 @@ CVE-Id: CVE-2023-25139 > Public-Date: 2023-02-02 > Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) > Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) > -Fix-Backport: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37) > +Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) > diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 > index 32e45f524f..5122669a64 100644 > --- a/advisories/GLIBC-SA-2023-0002 > +++ b/advisories/GLIBC-SA-2023-0002 > @@ -10,6 +10,6 @@ CVE-Id: CVE-2023-4527 > Public-Date: 2023-09-12 > Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) > Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) > -Fix-Backport: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36) > -Fix-Backport: b7529346025a130fee483d42178b5c118da971bb (2.37) > -Fix-Backport: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38) > +Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) > +Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) > +Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) > diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 > index 0950dc0792..d3aef80348 100644 > --- a/advisories/GLIBC-SA-2023-0003 > +++ b/advisories/GLIBC-SA-2023-0003 > @@ -8,8 +8,8 @@ arbitrary memory. > CVE-Id: CVE-2023-4806 > Public-Date: 2023-09-12 > Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) > -Fix-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34) > -Fix-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35) > -Fix-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36) > -Fix-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37) > -Fix-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38) > +Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) > +Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) > +Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) > +Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) > +Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) > diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 > index cba13db38f..5286a7aa54 100644 > --- a/advisories/GLIBC-SA-2023-0004 > +++ b/advisories/GLIBC-SA-2023-0004 > @@ -9,8 +9,8 @@ CVE-Id: CVE-2023-4911 > Public-Date: 2023-10-03 > Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) > Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) > -Fix-Backport: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34) > -Fix-Backport: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35) > -Fix-Backport: 22955ad85186ee05834e47e665056148ca07699c (2.36) > -Fix-Backport: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37) > -Fix-Backport: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38) > +Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) > +Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) > +Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) > +Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) > +Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) > diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 > index a518af803a..cc4eb90b82 100644 > --- a/advisories/GLIBC-SA-2023-0005 > +++ b/advisories/GLIBC-SA-2023-0005 > @@ -6,15 +6,13 @@ flags set. > > CVE-Id: CVE-2023-5156 > Public-Date: 2023-09-25 > -Vulnerable-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (pre-2.39) > -Fix-Commit: ec6b95c3303c700eb89eebeda2d7264cc184a796 (2.39) > -Vulnerable-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34) > -Vulnerable-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35) > -Vulnerable-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36) > -Vulnerable-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37) > -Vulnerable-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38) > -Fix-Backport: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34) > -Fix-Backport: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35) > -Fix-Backport: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36) > -Fix-Backport: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37) > -Fix-Backport: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38) > +Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) > +Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) > +Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) > +Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) > +Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) > +Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) > +Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) > +Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) > +Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) > +Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) > diff --git a/advisories/README b/advisories/README > new file mode 100644 > index 0000000000..94e68b1350 > --- /dev/null > +++ b/advisories/README > @@ -0,0 +1,73 @@ > +GNU C Library Security Advisory Format > +====================================== > + > +Security advisories in this directory follow a simple git commit log > +format, with a heading and free-format description augmented with tags > +to allow parsing key information. References to code changes are > +specific to the glibc repository and follow a specific format: > + > + Tag-name: (release-version) > + > +The indicates a specific commit in the repository. The > +release-version indicates the publicly consumable release in which this > +commit is known to exist. The release-version is derived from the > +git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and > +is of the form 2.34-NNN. If the -NNN suffix is absent, it means that > +the change is in that release tarball, otherwise the change is on the > +release/2.YY/master branch and not in any released tarball. > + > +The following tags are currently being used: > + > +CVE-Id: > +This is the CVE-Id assigned under the CVE Program > +(https://www.cve.org/). > + > +Public-Date: > +The date this issue became publicly known. > + > +Vulnerable-Commit: > +The commit that introduced this vulnerability. There could be multiple > +entries, one for each release branch in the glibc repository; the > +release-version portion of this tag should tell you which branch this is > +on. > + > +Fix-Commit: > +The commit that fixed this vulnerability. There could be multiple > +entries for each release branch in the glibc repository, indicating that > +all of those commits contributed to fixing that issue in each of those > +branches. > + > +Adding an Advisory > +------------------ > + > +An advisory for a CVE needs to be added on the master branch in two steps: > + > +1. Add the text of the advisory without any Fix-Commit tags along with > + the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. > + The advisories directory does not exist in release branches, so keep > + the advisory text commit distinct from the code changes, to ease > + backports. Ask for the GLIBC-SA advisory number from the security > + team. > + > +2. Finish all backports on release branches and then back on the msater > + branch, add all commit refs to the advisory using the Fix-Commit > + tags. Don't bother adding the release-version subscript since the > + next step will overwrite it. > + > +3. Run the process-advisories.sh script in the scripts directory on the > + advisory: > + > + scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN > + > + (replace YYYY-NNNN with the actual advisory number). > + > +4. Verify the updated advisory and push the result. > + > +Getting a NEWS snippet from advisories > +-------------------------------------- > + > +Run: > + > + scripts/process-advisories.sh news > + > +and copy the content into the NEWS file. > diff --git a/scripts/process-advisories.sh b/scripts/process-advisories.sh > new file mode 100755 > index 0000000000..a520fab5e6 > --- /dev/null > +++ b/scripts/process-advisories.sh > @@ -0,0 +1,85 @@ > +#!/bin/bash -e > +# Copyright The GNU Toolchain Authors. > +# This file is part of the GNU C Library. > +# > +# The GNU C Library is free software; you can redistribute it and/or > +# modify it under the terms of the GNU Lesser General Public > +# License as published by the Free Software Foundation; either > +# version 2.1 of the License, or (at your option) any later version. > +# > +# The GNU C Library is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > +# Lesser General Public License for more details. > +# > +# You should have received a copy of the GNU Lesser General Public > +# License along with the GNU C Library; if not, see > +# . > + > +if ! [ -d advisories ]; then > + echo "error: Run me from the toplevel directory of the glibc repository." > + exit 1 > +fi > + > +command=$1 > + > +usage () { > + cat >&2 < +usage: $0 {update|news} > +EOF > + exit 1 > +} > + > +command="$1" > + > +case "$command" in > + update|news) > + ;; > + *) > + usage > + ;; > +esac > + > +get_rel() { > + rel=$(git describe $1 | sed 's/glibc-\([^g]\+\)-g.*/\1/') > + # If the latest tag for the commit is the development tag, then increment > + # the release version. > + if echo $rel | grep -q "\.9000"; then > + rel=$(echo $rel | sed 's/2\.\([0-9]\+\)\.9000.*/\1/') > + rel="2.$((rel+1))" > + fi > + echo $rel > +} > + > +advisories_update() { > + advisory=$1 > + > + if [ -z $1 ]; then > + echo "Usage: $0 update GLIBC-SA-YYYY-NNNN" > + exit 1 > + fi > + > + advisory_file=advisories/$advisory > + > + grep --color=none Commit $advisory_file | awk '{printf "%s %s\n", $1, $2}' | > + while read t r; do > + rel=$(get_rel $r) > + echo "*** Updating: $t $r ($rel)" > + sed -i "s/^$t $r.*/$t $r ($rel)/" $advisory_file > + done > +} > + > +advisories_news() { > + rel=$(get_rel "HEAD") > + for f in $(grep -l "^Fix-Commit: .* ($rel)$" advisories/*); do > + echo -e " $(basename $f):" > + cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f) > + echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | > + while read line; do > + echo " $line" > + done > + echo > + done > +} > + > +advisories_$command $2 > diff --git a/scripts/process-fixed-cves.sh b/scripts/process-fixed-cves.sh > deleted file mode 100755 > index 7a870f57ae..0000000000 > --- a/scripts/process-fixed-cves.sh > +++ /dev/null > @@ -1,41 +0,0 @@ > -#!/bin/bash -e > -# Copyright The GNU Toolchain Authors. > -# This file is part of the GNU C Library. > -# > -# The GNU C Library is free software; you can redistribute it and/or > -# modify it under the terms of the GNU Lesser General Public > -# License as published by the Free Software Foundation; either > -# version 2.1 of the License, or (at your option) any later version. > -# > -# The GNU C Library is distributed in the hope that it will be useful, > -# but WITHOUT ANY WARRANTY; without even the implied warranty of > -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > -# Lesser General Public License for more details. > -# > -# You should have received a copy of the GNU Lesser General Public > -# License along with the GNU C Library; if not, see > -# . > - > -if ! [ -d advisories ]; then > - echo "error: Run me from the toplevel directory of the glibc repository." > - exit 1 > -fi > - > -release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#") > -minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - | > - grep -v "^#") > - > -if [ $release = "\"development\"" ]; then > - cur_rel=2.$((minor + 1)) > -else > - cur_rel=2.$minor > -fi > - > -for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do > - echo -e " $(basename $f):" > - cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f) > - echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do > - echo " $line" > - done > - echo > -done