> On Thu, Nov 30, 2017 at 02:55:52PM +0100, Ludovic Courtès wrote: > > I thought about it, but since it’s an unsual case, what about adding a > > special property to packages instead? You’d write: > > > > (package > > ;; … > > (properties '((fixed-vulnerabilities "CVE-123-4567" "CVE-123-4568")))) > > > > ‘guix lint’ would honor this property, and that would address both cases > > like this and situations where a CVE is known to no longer apply, as is > > the case with unversioned CVEs¹. > > > > Thoughts?
I'd rather the property's name more clearly reflect that it doesn't actually fix the vulnerability, but just prevents the linter from complaining about it. Someone who sees this property used in a package could reasonably assume that it's required to list all fixed CVEs in a 'fixed-vulnerabilities' list, and that it is the "single source of truth" for which bugs apply to a package. But, it would not actually have anything to do with that, just being a way to silence the linter. However, I can't think of a good idea for another name... On Thu, Nov 30, 2017 at 11:49:01PM +0200, Efraim Flashner wrote: > I like that idea. It also allows us to mitigate a CVE without needing to > specifically add a patch. I've attached my first attempt at implementing > it. I think of `guix lint -c cve` as one of many tools for discovering important problems in our packages, but I don't think that we must absolutely silence the linter. It's always going to be imprecise, with both false negative and positive results.
signature.asc
Description: PGP signature
