From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Daniel Lang <dalang@gmx.at>
Cc: "Yann E. MORIN" <yann.morin.1998@free.fr>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH v2] package/bind: drop CVE-2017-3139 from IGNORE_CVES
Date: Thu, 21 Sep 2023 08:44:58 +0200 [thread overview]
Message-ID: <20230921084458.1aff7ce8@windsurf> (raw)
In-Reply-To: <80570176-70c3-4eae-9df6-54242820b8e8@gmx.at>
On Thu, 21 Sep 2023 06:09:38 +0200
Daniel Lang <dalang@gmx.at> wrote:
> Not sure pkg-stats would be the right place as, at least in my uses of it,
> I simply expect it to collect information and present it to me.
> Just like it doesn't flag outdated packages, I wouldn't expect it to flag
> mismatched CVEs or outdated CPEs for that matter.
I'm not sure to follow you here. pkg-stats is a general tool to help
with package maintenance. It provides things like the number of
check-package warnings, the number of patches, the list of CVEs
affecting the package, so it's a perfect fit to also list the CVEs
ignored but not affecting the package.
> I haven't looked at check-package closely, but the actual checking should
> be doable.
> The problem that I see is NVD's new API, because the initial download of
> all CVEs now takes ~30 minutes or so. Seeing as check-package is run on
> Gitlab CI for every push, the database needs to somehow be kept between
> runs to avoid re-downloading everything.
I don't think putting this logic in check-package is reasonable. There
is nothing CVE related in check-package right, and like you point out,
the fact that it needs the CVE database is a big change that is going
to be annoying.
I maintain my position that this should be done in pkg-stats, where we
already do all the CVE matching dance, as it's a simple addition to
pkg-stats.
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2023-09-21 6:45 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-20 4:31 [Buildroot] [PATCH v2] package/bind: drop CVE-2017-3139 from IGNORE_CVES Daniel Lang
2023-09-20 7:12 ` Thomas Petazzoni via buildroot
2023-09-20 17:34 ` Yann E. MORIN
2023-09-21 4:09 ` Daniel Lang
2023-09-21 6:44 ` Thomas Petazzoni via buildroot [this message]
2023-09-20 17:37 ` Yann E. MORIN
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230921084458.1aff7ce8@windsurf \
--to=buildroot@buildroot.org \
--cc=dalang@gmx.at \
--cc=thomas.petazzoni@bootlin.com \
--cc=yann.morin.1998@free.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.