patchtest can take malicious patches and in the testing/execution phase, these may do some damage on the system that patchtest is running. The framework should either work in isolation (container?) or find a way to detect malicious patches before processing.
This work is in progress and should be finished early 2.2M2.
Moving back to M1. Any change on milestone must be discussed previously with the CCB.
Current proposal is being reviewed internally, so moving the bug's status.
The approach suggested to isolate the patchtest execution was the following: a qemu machine as VM, launched with arguments indicating a common share folder (virtualized with virtFS) previously populated with all required data: repos and mboxes. Once launched, the machine will automatically execute patchtest and created a folder with results. Once all mboxes are tested, the machine will shutdown; host would parse the output folder and post results. Moving to In Progress Implementation because the qemu machine is not yet ready. What is missing is a custom layer containing two main things: a init script (to launch the execution and shutdown) and required recipes/packages for the final image. The above approach was considered secured enough so this allows to expose patchtest and patchtest-oe code **once** the qemu machine is ready.
Documentation/code being reviewed internally (security team) before it can go public.
The security team has fully approved the approach taken to isolate patchtest, so the source code (both patchtest and patchtest-oe) can go public.