On a Tuesday in 2026, Peter Krempa via Devel wrote:
From: Peter Krempa <[email protected]>Introduce a job which will run with the scheduled libvirt pipeline runs which will check if all CVEs mentioned in the git commit messages, NEWS entries and for all libvirt security notices published at https://security.libvirt.org have corresponding git tags. Since git commit messages do sometimes mention CVE not related to libvirt, the '.cve_exceptions' file lists allows to add overrides. Since the upstream repository has signed tags, the tagging is done by Jirka, so it doesn't make sense to run this check inside the checkout or as a regular CI pipeline run, so it's implemented directly in the CI job rather than as a standalone tool. The job also creates an artifact containing all tagged CVEs in the repository. This can later be used e.g. to see which CVEs are missing a libvirt security notice. Signed-off-by: Peter Krempa <[email protected]> --- .cve_exceptions | 46 +++++++++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 .cve_exceptions
Reviewed-by: Ján Tomko <[email protected]> Jano
signature.asc
Description: PGP signature
