CVE patchtes sent to the openembedded mailing list should be tested with patchtest/patchwork for proper format. Proper format at least means indicating the CVE number in the summary and the string 'CVE: CVE-<number>' in the patch description area. An example for correct formatting would be http://patchwork.openembedded.org/patch/117791/
A link that shows how to create a CVE patch: http://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines#CVE_Patches
Expected to be finished early 2.2M2.
My fault, moving it to M1 again. CCB should agree on any milestone movement.
This is already implemented but not tested.
Sent patches to Leo
This check is already implemented on the patchtest-oe suite. The way to validate this check is through 'selftest' implemented on patchtest-oe repo + clone patchtest and patchtest-oe (right now these are not public), follow patchtest-oe setup instructions + run the following cmd: cd $patchtest-oe/selftest; ./selftest + expected output: no output should be seen on console