Re: [OE-core] [PATCH] cve-check: Add allowlist that is same function of whitelist.

["Armin Kuster" <akuster808@gmail.com>]

On 6/26/21 3:04 AM, Richard Purdie wrote:
> On Wed, 2021-06-23 at 17:56 +0900, ito-yuichi@fujitsu.com wrote:
>> The Linux team plan to removed references to racially-charged jargon from
>> their code for more neutral and inclusive language.
>> So replace use of "whitelist" with "allowlist" in cve-check.
>>
>> First, we add CVE_CHECK_ALLOWLIST and it is considered patched as well as
>> CVE_CHECK_WHITELIST.
>> We plan to replace about other word later and eventualy, replace all
>> "whitelist" to "allowlist".
>>
>> Signed-off-by: Yuichi Ito <ito-yuichi@fujitsu.com>
> The TSC did discuss this and proposed a plan on how we should go about 
> addressing these issues:
>
> https://lists.openembedded.org/g/openembedded-architecture/topic/inclusive_language_summary/75821819
>
> I appreciate this patch has good intent but I would really like to
> see a wider plan on how we address this rather than changing single 
> variables piecemeal. 
>
> For example we may want to standardise on the term "IGNORE" rather than
> "ALLOW" or even "FILTER" or "VERIFIED" or something more specific to the meaning
> of CVEs and CVE checking.
>
> There is an opportunity to try and make the metadata and variable names
> more consistent and understandable but if we just change single things at
> a time this opportunity would be missed.

I have created a wiki page to collate our thoughts and agreements to
help us move foreword in a coherent manner to address renaming some
troubling variable names.
https://wiki.yoctoproject.org/wiki/Inclusive_language

I logged some variable names along with a few renaming examples. Maybe
this can turn into a plan???

Since it's a wiki, please edit accordingly.

- armin


Cheers,
> Richard
>
>
> 
>