Now the patches to upstream sources don't say if this patch is a CVE. We need to define a upstream patching format for mark patches that are CVE's. to help to make track of CVE vulnerabilities into recipes.
Clearing 2.0 milestone
Clear Linux (and the cve checking tool they use) simply states that CVE patches have "cve-XXXX-YYYY" in the filename somewhere. We *could* go a step further and add a new metadata tag to the patch header alongside Upstream-Status, maybe just as simple as CVE: CVE-2015-1234. From an impact to the repository point of view, adding a new tag is easier as it's just a matter of adding a single line to the file instead of renaming and updating recipes.
Hey Ross, is this something like adding that tag in the [Tags] section of the commit? ------------------------ <commit title> [commit message] [Tags] <Signature> -----------------------
Upstream-Status: Security I would also have the CVSS score too. ie: CVE: CVE-yyyy-xxxx CVSS: (0 -10) this info is can be used when creating release notes.
I started a RFC thread in OE-core, OE-devel, so we get more input. Feel free to comment. http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114166.html
Will wait after the holidays to reach a conclusion
is today after the holidays? :)
Very funny! You can check the thread conclusion in: http://lists.openembedded.org/pipermail/openembedded-core/2016-January/114770.html I will update the wiki to reflect this.
The wiki has been updated to reflect this change: http://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines#CVE_Patches Now all the patches, that solve CVEs, must have the "CVE:" tag in header
Verified: The wiki was indeed updated.