13111 2018-12-31 01:18:38 +0000 Connect SRTool to YP Bugzilla 2024-05-09 16:56:48 +0000 1 1 6 Yocto Project Subprojects Security Response Tool General 2.7 x86 Multiple RESOLVED WONTFIX Medium enhancement 5.0 M4 1 david.reyna david.reyna akuster david.reyna randy.macleod --- --- No (bug/feature does not impact docs) oldest_to_newest 82629 0 david.reyna 2018-12-31 01:18:38 +0000 The "bin/yp/srtool_defect.py" needs to be updated to connect the SRTool to the CVEs in YP Bugzilla. * The "init" function should be able to find existing CVE-related bugs, and then instantiate "Vulnerabilities" and "Investigations" accordingly. * Similarly, the "update" function should be able to update the respective defect status in the SRTool database. * The tool should also instantiate the defect creation feature. An example of a Jira integration script can be found in "bin/acme/srtool_jira.sh". 83080 1 david.reyna 2019-02-21 20:03:47 +0000 Here is some added context. This enhancement is about Yocto Project's desired implementation of the SRtool. The basic implementation would be to simply track the status of CVEs in the Yocto Project code base. The data can be dynamically derived from Bugzilla defects (as per this case) and/or from data supplied by partner companies. From this, Yocto Project could generate reports and tables. The next level of implementation would be to proactively track incoming CVEs and capture their potential impact on Yocto Project. The potential vulnerabilities can then be shared with the partner companies for assistance with the response. The full implementation would be to use the incoming data to proactively create Yocto Project defects to track and resolve critical and common vulnerabilities. - David 86147 2 ross.burton 2020-01-29 16:35:41 +0000 Assigning to David so this isn't lost, but I won't be working on this any time soon. 98989 3 david.reyna 2024-05-09 16:56:48 +0000 This will not be done until a mandate exists and is scheduled. At that time we can open a new case.