mirror of
git://sourceware.org/git/glibc.git
synced 2024-11-27 03:41:23 +08:00
60c57b8467
One of the requirements to becoming a CVE Numbering Authority (CNA) is to publish advisories. Do this by maintaining a file for each CVE fixed in the advisories directory in the source tree. Links to the advisories can then be shared as: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-YYYY-NNNN The file format at the moment is rudimentary and derives from the git commit format, i.e. a subject line and a potentially multi-paragraph description and then tags to describe some meta information. This is a loose format at the moment and could change as we evolve this. Also add a script process-fixed-cves.sh that processes these advisories and generates a list to add to NEWS at release time. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
42 lines
1.4 KiB
Bash
Executable File
42 lines
1.4 KiB
Bash
Executable File
#!/bin/bash -e
|
|
# Copyright The GNU Toolchain Authors.
|
|
# This file is part of the GNU C Library.
|
|
#
|
|
# The GNU C Library is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
# License as published by the Free Software Foundation; either
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
#
|
|
# The GNU C Library is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# Lesser General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Lesser General Public
|
|
# License along with the GNU C Library; if not, see
|
|
# <https://www.gnu.org/licenses/>.
|
|
|
|
if ! [ -d advisories ]; then
|
|
echo "error: Run me from the toplevel directory of the glibc repository."
|
|
exit 1
|
|
fi
|
|
|
|
release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#")
|
|
minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - |
|
|
grep -v "^#")
|
|
|
|
if [ $release = "\"development\"" ]; then
|
|
cur_rel=2.$((minor + 1))
|
|
else
|
|
cur_rel=2.$minor
|
|
fi
|
|
|
|
for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do
|
|
echo -e " $(basename $f):"
|
|
cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f)
|
|
echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do
|
|
echo " $line"
|
|
done
|
|
echo
|
|
done
|