Re: [OE-core] [PATCH] cve-check-map: Add 'cannot-backport' to status map

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Tue, 2024-07-23 at 21:44 -0700, Dhairya Nagodra via lists.openembedded.org wrote:
> - Sometimes, the difference in the codebase of the fixed CVE's version
>   and the current version of the package is huge.
> - This would make the backporting of the CVE not a feasible option.
> - And due to other dependencies and limitations, the upgrade of the
>   package might not be possible as well.
> - This commit would allow users to add a description via CVE_STATUS and
>   still show the CVE as vulnerable.
> 
> Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com>
> ---
>  meta/conf/cve-check-map.conf | 2 ++
>  1 file changed, 2 insertions(+)

I don't think this status make sense as it is too hard to define. For
one person, a cannot backport might be a patch that doesn't apply
cleanly, all the way through to a patch which would need many hours of
work to correctly apply to an earlier version.

I think this classification would be too arbitrary and depends on the
person's skill set too much.

Cheers,

Richard