Bug 16158

Summary: patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file
Product: [Yocto Project Subprojects] Patchwork/Patchtest Reporter: Yoann Congal <yoann.congal>
Component: Patchtest TestsuiteAssignee: Trevor Gamblin <tgamblin>
Status: NEW --- QA Contact:
Severity: normal    
Priority: Medium CC: ccasciato, randy.macleod, yoann.congal
Version: unspecified   
Target Milestone: 6.2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Yoann Congal 2026-02-03 22:36:09 UTC 
Right now, patchtest only test for "CVE: CVE-XXXX-YYYY" in patches if a "CVE-XXXX-YYYY" is present in title or commit message[0].

But a user could (and did[0]) send a CVE fixing patch without a CVE-XXXX-YYYY in neither commit message nor title.

=> patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file
Looking for CVE-XXXX-YYYY in added patch body might lead to too much false positive but in the filename, I feel like it should be fine.

[0]: https://git.openembedded.org/openembedded-core/tree/meta/lib/patchtest/tests/test_patch.py#n166
[1]: https://lists.openembedded.org/g/openembedded-core/message/229210