Re: [OE-core][PATCH v4 1/3] cve-check: add option to add additional patched CVEs

Valek, Andrej
2023-05-19T13:19:18Z

Hello Michael,

I wanted to use a "CVE_STATUS_REASON", but it was advised here
https://lists.openembedded.org/g/openembedded-core/message/181037 by Richard. So
I was thinking, that it has to correct.

Regards,
Andrej

On Fri, 2023-05-19 at 15:09 +0200, Michael Opdenacker wrote:
> Hi Andrej,
>
> On 19.05.23 at 10:18, Andrej Valek via lists.openembedded.org wrote:
> > - Replace CVE_CHECK_IGNORE with CVE_STATUS + [CVE_STATUS_REASONING] to be
> > more flexible. CVE_STATUS should contain flag for each CVE with accepted
> > values "Ignored", "Not applicable" or "Patched". It allows to add
> > a status for each CVEs.
> > - Optional CVE_STATUS_REASONING flag variable may contain a reason
> > why the CVE status was used. It will be added in csv/json report like
> > a new "reason" entry.
>
>
> I'm not a native English speaker, but what about just
> "CVE_STATUS_REASON" instead of "CVE_STATUS_REASONING"?
>
> "Reasoning" is a mental process if I understand correctly. See
> https://www.englishforums.com/English/ReasonVsReasoning/zdgdw/post.htm.
> It seems to me that the term "reason" should be sufficient, as the
> "reason" flag that you're using.
>
> I'd be interested in what others think about this...
> Thanks in advance
> Cheers
>
> Michael.
>