all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve
@ 2018-05-12 23:32 Björn Höfling
  2018-05-12 23:40 ` [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint Björn Höfling
  2018-05-12 23:40 ` [bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs Björn Höfling
  0 siblings, 2 replies; 5+ messages in thread
From: Björn Höfling @ 2018-05-12 23:32 UTC (permalink / raw)
  To: 31437

[-- Attachment #1: Type: text/plain, Size: 389 bytes --]

These two little patches are a follow-up to

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=30801

Björn


Björn Höfling (2):
  doc: Update documentation of guix lint
  gnu: opencv: Ignore CVEs.

 doc/guix.texi                     | 22 +++++++++++++++++++---
 gnu/packages/image-processing.scm |  5 +++++
 2 files changed, 24 insertions(+), 3 deletions(-)

-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint
  2018-05-12 23:32 [bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve Björn Höfling
@ 2018-05-12 23:40 ` Björn Höfling
  2018-05-14  8:59   ` Ludovic Courtès
  2018-05-12 23:40 ` [bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs Björn Höfling
  1 sibling, 1 reply; 5+ messages in thread
From: Björn Höfling @ 2018-05-12 23:40 UTC (permalink / raw)
  To: 31437

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]


* doc/guix.texi (Invoking guix lint): Add cpe-version to example.
* doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.
---
 doc/guix.texi | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 637c9c3f4..f0b666b9e 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -6835,15 +6835,31 @@ where @code{CVE-YYYY-ABCD} is the CVE identifier---e.g.,
 
 Package developers can specify in package recipes the
 @uref{https://nvd.nist.gov/cpe.cfm,Common Platform Enumeration (CPE)}
-name and version of the package when they differ from the name that Guix
-uses, as in this example:
+name and version of the package when they differ from the name or version
+that Guix uses, as in this example:
 
 @example
 (package
   (name "grub")
   ;; @dots{}
   ;; CPE calls this package "grub2".
-  (properties '((cpe-name . "grub2"))))
+  (properties '((cpe-name . "grub2")
+                (cpe-version . "2.3")))
+@end example
+
+Sometimes, the CVE database contains false positives.  Package developers who
+found CVE alerts and verified they can be ignored can declare them as in
+this example:
+
+@example
+(package
+  (name "t1lib")
+  ;; @dots{}
+  ;; These CVEs are false positives and can be ignored:
+    (properties `((lint-hidden-cve . ("CVE-2011-0433"
+                                     "CVE-2011-1553"
+                                     "CVE-2011-1554"
+                                     "CVE-2011-5244")))))
 @end example
 
 @item formatting
-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs.
  2018-05-12 23:32 [bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve Björn Höfling
  2018-05-12 23:40 ` [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint Björn Höfling
@ 2018-05-12 23:40 ` Björn Höfling
  2018-05-14  9:03   ` bug#31437: " Ludovic Courtès
  1 sibling, 1 reply; 5+ messages in thread
From: Björn Höfling @ 2018-05-12 23:40 UTC (permalink / raw)
  To: 31437

[-- Attachment #1: Type: text/plain, Size: 1075 bytes --]


* gnu/packages/image-processing.scm (opencv)[properties]:  Add a
lint-hidden-cve property and add three CVEs to be ignored.
---
 gnu/packages/image-processing.scm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gnu/packages/image-processing.scm
b/gnu/packages/image-processing.scm index ef303e134..4842ad450 100644
--- a/gnu/packages/image-processing.scm
+++ b/gnu/packages/image-processing.scm
@@ -222,6 +222,11 @@ integrates with various databases on GUI toolkits
such as Qt and Tk.") (for-each delete-file
                             '("modules/java/test/pure_test/lib/junit-4.11.jar"
                               "samples/java/sbt/sbt/sbt-launch.jar"))))))
+    ;; These three CVEs are not a problem of OpenCV, see:
+    ;; https://github.com/opencv/opencv/issues/10998
+    (properties '((lint-hidden-cve . ("CVE-2018-7712"
+                                      "CVE-2018-7713"
+                                      "CVE-2018-7714"))))
     (build-system cmake-build-system)
     (arguments
      `(#:configure-flags
-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint
  2018-05-12 23:40 ` [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint Björn Höfling
@ 2018-05-14  8:59   ` Ludovic Courtès
  0 siblings, 0 replies; 5+ messages in thread
From: Ludovic Courtès @ 2018-05-14  8:59 UTC (permalink / raw)
  To: Björn Höfling; +Cc: 31437

Hello,

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> * doc/guix.texi (Invoking guix lint): Add cpe-version to example.
> * doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.

I reworded the bit about ‘lint-hidden-cve’, mostly so that packagers
don’t start using it without a very good reason ;-), and committed.

Thanks!

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#31437: [PATCH 2/2] gnu: opencv: Ignore CVEs.
  2018-05-12 23:40 ` [bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs Björn Höfling
@ 2018-05-14  9:03   ` Ludovic Courtès
  0 siblings, 0 replies; 5+ messages in thread
From: Ludovic Courtès @ 2018-05-14  9:03 UTC (permalink / raw)
  To: Björn Höfling; +Cc: 31437-done

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> * gnu/packages/image-processing.scm (opencv)[properties]:  Add a
> lint-hidden-cve property and add three CVEs to be ignored.

Applied, thanks!

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2018-05-14  9:04 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-12 23:32 [bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve Björn Höfling
2018-05-12 23:40 ` [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint Björn Höfling
2018-05-14  8:59   ` Ludovic Courtès
2018-05-12 23:40 ` [bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs Björn Höfling
2018-05-14  9:03   ` bug#31437: " Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.