Bug 13111

Summary: Connect SRTool to YP Bugzilla
Product: [Yocto Project Subprojects] Security Response Tool Reporter: David Reyna <david.reyna>
Component: GeneralAssignee: David Reyna <david.reyna>
Status: RESOLVED WONTFIX QA Contact:
Severity: enhancement    
Priority: Medium CC: akuster, david.reyna, randy.macleod
Version: 2.7   
Target Milestone: 5.0 M4   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description David Reyna 2018-12-31 01:18:38 UTC 
The "bin/yp/srtool_defect.py" needs to be updated to connect the SRTool to the CVEs in YP Bugzilla.

* The "init" function should be able to find existing CVE-related bugs, and then instantiate "Vulnerabilities" and "Investigations" accordingly.

* Similarly, the "update" function should be able to update the respective defect status in the SRTool database.

* The tool should also instantiate the defect creation feature.

An example of a Jira integration script can be found in "bin/acme/srtool_jira.sh".
Comment 1 David Reyna 2019-02-21 20:03:47 UTC 
Here is some added context.

This enhancement is about Yocto Project's desired implementation of the SRtool.

The basic implementation would be to simply track the status of CVEs in the Yocto Project code base. The data can be dynamically derived from Bugzilla defects (as per this case) and/or from data supplied by partner companies. From this, Yocto Project could generate reports and tables.

The next level of implementation would be to proactively track incoming CVEs and capture their potential impact on Yocto Project. The potential vulnerabilities can then be shared with the partner companies for assistance with the response.

The full implementation would be to use the incoming data to proactively create Yocto Project defects to track and resolve critical and common vulnerabilities.

- David
Comment 2 Ross Burton 2020-01-29 16:35:41 UTC 
Assigning to David so this isn't lost, but I won't be working on this any time soon.
Comment 3 David Reyna 2024-05-09 16:56:48 UTC 
This will not be done until a mandate exists and is scheduled. At that time we can open a new case.