From nobody Wed May 14 15:06:14 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1520962075896860.2336719045411; Tue, 13 Mar 2018 10:27:55 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4F0F523E6C1; Tue, 13 Mar 2018 17:27:54 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2177F5E1D1; Tue, 13 Mar 2018 17:27:54 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id D5810181BA06; Tue, 13 Mar 2018 17:27:53 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w2DHRocU005696 for ; Tue, 13 Mar 2018 13:27:50 -0400 Received: by smtp.corp.redhat.com (Postfix) id 7F034202322A; Tue, 13 Mar 2018 17:27:50 +0000 (UTC) Received: from t460.redhat.com (unknown [10.33.36.27]) by smtp.corp.redhat.com (Postfix) with ESMTP id 101D1202322C; Tue, 13 Mar 2018 17:27:49 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Tue, 13 Mar 2018 17:27:37 +0000 Message-Id: <20180313172737.24214-5-berrange@redhat.com> In-Reply-To: <20180313172737.24214-1-berrange@redhat.com> References: <20180313172737.24214-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH security-notice 4/4] Add a script for generating a list of vulnerable tags & branches X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Tue, 13 Mar 2018 17:27:54 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 It is rather tedious making the list of vulnerable tags and branches for the security notice reports. This script takes the changeset of the commit that first introduced the flaw and then outputs an XML snippet listing every tag and branch which contains that vulnerable changeset. This can be copied straight into the security notice, meaning we just have to then fill out details of which changeset and tag fixed the flaw. Signed-off-by: Daniel P. Berrang=C3=A9 --- scripts/report-vulnerable-tags.pl | 108 ++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 108 insertions(+) create mode 100644 scripts/report-vulnerable-tags.pl diff --git a/scripts/report-vulnerable-tags.pl b/scripts/report-vulnerable-= tags.pl new file mode 100644 index 0000000..0b6ea6f --- /dev/null +++ b/scripts/report-vulnerable-tags.pl @@ -0,0 +1,108 @@ +#!/usr/bin/perl + +use strict; +use warnings; + +use Sort::Versions; + +if (int(@ARGV) !=3D 1) { + die "syntax: $0 CHANGESET\n"; +} + +my $changeset =3D shift @ARGV; + +sub get_tags { + my @args =3D @_; + + my @tags; + open GIT, "-|", "git", "tag", @args or + die "cannot query 'git tags @args': $!\n"; + + while () { + chomp; + + # Drop anything except vN.N.N style tags + # where 'N' is only digits. + if (/^v(\d+)(\.\d+)+$/) { + push @tags, $_; + } + } + + close GIT; + + return @tags; +} + +sub get_branch { + my $tag =3D shift; + + my @branches; + open GIT, "-|", "git", "branch", "--all", "--contains", $tag or + die "cannot query 'git branch --all --contains $tag': $!\n"; + + while () { + chomp; + + if (m,^\s*remotes/origin/(v.*-maint)$,) { + push @branches, $1; + } + } + + close GIT; + + return @branches; +} + +my @branches; +my %tags; +my %branches; + +$branches{"master"} =3D []; +# Most tags live on master so lets get them first +for my $tag (get_tags("--contains", $changeset, "--merged", "master")) { + push @{$branches{"master"}}, $tag; + $tags{$tag} =3D 1; +} +push @branches, "master"; + +# Now we need slower work to find branches for +# few remaining tags +for my $tag (get_tags("--contains", $changeset)) { + + next if exists $tags{$tag}; + + my @tagbranches =3D get_branch($tag); + if (int(@tagbranches) =3D=3D 0) { + if ($tag eq "v2.1.0") { + @tagbranches =3D ("master") + } else { + print "Tag $tag doesn't appear in any branch\n"; + next; + } + } + + if (int(@tagbranches) > 1) { + print "Tag $tag appears in multiple branches\n"; + } + + unless (exists($branches{$tagbranches[0]})) { + $branches{$tagbranches[0]} =3D []; + push @branches, $tagbranches[0]; + } + push @{$branches{$tagbranches[0]}}, $tag; +} + + +foreach my $branch (sort versioncmp @branches) { + print " \n"; + print " $branch\n"; + foreach my $tag (sort versioncmp @{$branches{$branch}}) { + print " $tag\n"; + } + print " $changeset\n"; + + if ($branch eq "master") { + print " \n"; + } + print " \n"; +} --=20 2.14.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list