b4 filters out Fixes: lines

b4 filters out Fixes: lines

[Marc-André Lureau]

Hi Konstantin,

Since commit dccab10473b5 ("trailers: reject malformed Fixes: trailer
values"), b4 filters out anything that is not a commit hash-like line.
But various projects, such as QEMU, use Fixes: lines to reference CVE#
and sometime report/issue URLs. Can we relax the validation? Should we
make this configurable?

Thanks,

Re: b4 filters out Fixes: lines

[Konstantin Ryabitsev]

On Mon, Aug 10, 2026 at 11:59:59AM +0400, Marc-André Lureau wrote:
> Since commit dccab10473b5 ("trailers: reject malformed Fixes: trailer
> values"), b4 filters out anything that is not a commit hash-like line.
> But various projects, such as QEMU, use Fixes: lines to reference CVE#
> and sometime report/issue URLs. Can we relax the validation? Should we
> make this configurable?

Right, this was tightened because "Fixes:" is a one-word trailer and we can
legitimately find it on the line followed by arbitrary prose.

I'm not against broadening it to include URLs, but I'm less sure about
arbitrary strings like CVE-NNNN-NNN.

Regarding making it configurable, it would probably be more worthwhile to make
the whole list of follow-up trailers configurable, as a list of regexes, e.g.:

b4.followup-trailers = 
    Fixes: CVE-.*
    Fixes: https?://.*
    Closes: https?://.*

I'd lean in this direction as opposed to just a special-case for the Fixes:
trailer.

-K