Update advisory format and introduce some automation
Checks
Commit Message
Simplify the advisory format by dropping the -Backport tags and instead
stick to using just the -Commit tags. To identify backports, put a
substring of git-describe into the release version in the brackets next
to the commit ref. This way, it not only identifies that the fix (or
regression) is on the release/2.YY/master branch, it also disambiguates
regressions/fixes in the branch from those in the tarball.
Add a README to make it easier for consumers to understand the format.
Additionally, the Release wiki needs to be updated to inform the release
manager to:
1. Generate a NEWS snipped from the advisories directory
AND
2. on release/2.YY/master, replace the advisories directory with a text
file pointing to the advisories directory in master so that we don't
have to update multiple locations.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
advisories/GLIBC-SA-2023-0001 | 2 +-
advisories/GLIBC-SA-2023-0002 | 6 +--
advisories/GLIBC-SA-2023-0003 | 10 ++---
advisories/README | 70 +++++++++++++++++++++++++++++
scripts/process-advisories.sh | 85 +++++++++++++++++++++++++++++++++++
scripts/process-fixed-cves.sh | 41 -----------------
6 files changed, 164 insertions(+), 50 deletions(-)
create mode 100644 advisories/README
create mode 100755 scripts/process-advisories.sh
delete mode 100755 scripts/process-fixed-cves.sh
@@ -11,4 +11,4 @@ CVE-Id: CVE-2023-25139
Public-Date: 2023-02-02
Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37)
Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38)
-Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37)
+Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4)
@@ -10,6 +10,6 @@ CVE-Id: CVE-2023-4527
Public-Date: 2023-09-12
Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36)
Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39)
-Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36)
-Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37)
-Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38)
+Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113)
+Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38)
+Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19)
@@ -8,8 +8,8 @@ arbitrary memory.
CVE-Id: CVE-2023-4806
Public-Date: 2023-09-12
Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39)
-Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34)
-Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35)
-Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36)
-Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37)
-Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38)
+Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420)
+Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270)
+Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115)
+Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39)
+Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20)
new file mode 100644
@@ -0,0 +1,70 @@
+GNU C Library Security Advisory Format
+======================================
+
+Security advisories in this directory follow a simple git commit log
+format, with a heading and free-format description augmented with tags
+to allow parsing key information. References to code changes are
+specific to the glibc repository and follow a specific format:
+
+ Tag-name: <commit-ref> (release-version)
+
+The <commit-ref> indicates a specific commit in the repository. The
+release-version indicates the publicly consumable release in which this
+commit is known to exist. For a simple release-version, e.g. 2.34, this
+change is present in release tarballs. For release-version of the form
+2.34-NNN (e.g. 2.34-42), the change is on the release/2.34/master
+branch and not in any released tarball.
+
+The following tags are currently being used:
+
+CVE-Id:
+This is the CVE-Id assigned under the CVE Program
+(https://www.cve.org/).
+
+Public-Date:
+The date this issue became publicly known.
+
+Vulnerable-Commit:
+The commit that introduced this vulnerability. There could be multiple
+entries, one for each release branch in the glibc repository; the
+release-version portion of this tag should tell you which branch this is
+on.
+
+Fix-Commit:
+The commit that fixed this vulnerability. There could be multiple
+entries for each release branch in the glibc repository, indicating that
+all of those commits contributed to fixing that issue in each of those
+branches.
+
+Adding an Advisory
+------------------
+
+An advisory for a CVE needs to be added in two steps:
+
+1. Add the text of the advisory without any Fix-Commit tags along with
+ the fix for the CVE. Add the Vulnerable-Commit tag, if applicable.
+ The advisories directory does not exist in branches, so keep the
+ advisory text commit distinct from the code changes, to ease
+ backports. Ask for the GLIBC-SA advisory number from the security
+ team.
+
+2. Finish all backports and then add all commits to the advisory using
+ the Fix-Commit tags. Don't add the release-version subscript.
+
+3. Run the process-advisories.sh script in the scripts directory on the
+ advisory:
+
+ scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN
+
+ (replace YYYY-NNNN with the actual advisory number).
+
+4. Verify the updated advisory and push the result.
+
+Getting a NEWS snippet from advisories
+--------------------------------------
+
+Run:
+
+ scripts/process-advisories.sh news
+
+and copy the content into the NEWS file.
new file mode 100755
@@ -0,0 +1,85 @@
+#!/bin/bash -e
+# Copyright The GNU Toolchain Authors.
+# This file is part of the GNU C Library.
+#
+# The GNU C Library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# The GNU C Library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNU C Library; if not, see
+# <https://www.gnu.org/licenses/>.
+
+if ! [ -d advisories ]; then
+ echo "error: Run me from the toplevel directory of the glibc repository."
+ exit 1
+fi
+
+command=$1
+
+usage () {
+ cat >&2 <<EOF
+usage: $0 {update|news}
+EOF
+ exit 1
+}
+
+command="$1"
+
+case "$command" in
+ update|news)
+ ;;
+ *)
+ usage
+ ;;
+esac
+
+get_rel() {
+ rel=$(git describe $1 | sed 's/glibc-\([^g]\+\)-g.*/\1/')
+ # If the latest tag for the commit is the development tag, then increment
+ # the release version.
+ if echo $rel | grep -q "\.9000"; then
+ rel=$(echo $rel | sed 's/2\.\([0-9]\+\)\.9000.*/\1/')
+ rel="2.$((rel+1))"
+ fi
+ echo $rel
+}
+
+advisories_update() {
+ advisory=$1
+
+ if [ -z $1 ]; then
+ echo "Usage: $0 update GLIBC-SA-YYYY-NNNN"
+ exit 1
+ fi
+
+ advisory_file=advisories/$advisory
+
+ grep --color=none Commit $advisory_file | awk '{printf "%s %s\n", $1, $2}' |
+ while read t r; do
+ rel=$(get_rel $r)
+ echo "*** Updating: $t $r ($rel)"
+ sed -i "s/^$t $r.*/$t $r ($rel)/" $advisory_file
+ done
+}
+
+advisories_news() {
+ rel=$(get_rel "HEAD")
+ for f in $(grep -l "^Fix-Commit: .* ($rel)$" advisories/*); do
+ echo -e " $(basename $f):"
+ cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f)
+ echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s |
+ while read line; do
+ echo " $line"
+ done
+ echo
+ done
+}
+
+advisories_$command $2
deleted file mode 100755
@@ -1,41 +0,0 @@
-#!/bin/bash -e
-# Copyright The GNU Toolchain Authors.
-# This file is part of the GNU C Library.
-#
-# The GNU C Library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# The GNU C Library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with the GNU C Library; if not, see
-# <https://www.gnu.org/licenses/>.
-
-if ! [ -d advisories ]; then
- echo "error: Run me from the toplevel directory of the glibc repository."
- exit 1
-fi
-
-release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#")
-minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - |
- grep -v "^#")
-
-if [ $release = "\"development\"" ]; then
- cur_rel=2.$((minor + 1))
-else
- cur_rel=2.$minor
-fi
-
-for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do
- echo -e " $(basename $f):"
- cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f)
- echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do
- echo " $line"
- done
- echo
-done