16158 2026-02-03 22:36:09 +0000 patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file 2026-10-30 14:56:50 +0000 1 1 6 Yocto Project Subprojects Patchwork/Patchtest Patchtest Testsuite unspecified x86 Multiple NEW Medium normal 6.2 1 yoann.congal tgamblin ccasciato randy.macleod yoann.congal --- --- No (bug/feature does not impact docs) oldest_to_newest 104144 0 yoann.congal 2026-02-03 22:36:09 +0000 Right now, patchtest only test for "CVE: CVE-XXXX-YYYY" in patches if a "CVE-XXXX-YYYY" is present in title or commit message[0]. But a user could (and did[0]) send a CVE fixing patch without a CVE-XXXX-YYYY in neither commit message nor title. => patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file Looking for CVE-XXXX-YYYY in added patch body might lead to too much false positive but in the filename, I feel like it should be fine. [0]: https://git.openembedded.org/openembedded-core/tree/meta/lib/patchtest/tests/test_patch.py#n166 [1]: https://lists.openembedded.org/g/openembedded-core/message/229210