Bug 16158 - patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file
Summary: patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YY...
Status: NEW
Alias: None
Product: Patchwork/Patchtest
Classification: Yocto Project Subprojects
Component: Patchtest Testsuite (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium normal
Target Milestone: 6.2
Assignee: Trevor Gamblin
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2026-02-03 22:36 UTC by Yoann Congal
Modified: 2026-10-30 14:56 UTC (History)
3 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yoann Congal 2026-02-03 22:36:09 UTC 
Right now, patchtest only test for "CVE: CVE-XXXX-YYYY" in patches if a "CVE-XXXX-YYYY" is present in title or commit message[0].

But a user could (and did[0]) send a CVE fixing patch without a CVE-XXXX-YYYY in neither commit message nor title.

=> patchtest should trigger the "CVE: CVE-XXXX-YYYY" test for added "CVE-XXXX-YYYY.patch" file
Looking for CVE-XXXX-YYYY in added patch body might lead to too much false positive but in the filename, I feel like it should be fine.

[0]: https://git.openembedded.org/openembedded-core/tree/meta/lib/patchtest/tests/test_patch.py#n166
[1]: https://lists.openembedded.org/g/openembedded-core/message/229210