[bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve

[bug#31437] [PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 389 bytes --]

These two little patches are a follow-up to

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=30801

Björn


Björn Höfling (2):
  doc: Update documentation of guix lint
  gnu: opencv: Ignore CVEs.

 doc/guix.texi                     | 22 +++++++++++++++++++---
 gnu/packages/image-processing.scm |  5 +++++
 2 files changed, 24 insertions(+), 3 deletions(-)

-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[bug#31437] [PATCH 1/2] doc: Update documentation of guix lint

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]


* doc/guix.texi (Invoking guix lint): Add cpe-version to example.
* doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.
---
 doc/guix.texi | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 637c9c3f4..f0b666b9e 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -6835,15 +6835,31 @@ where @code{CVE-YYYY-ABCD} is the CVE identifier---e.g.,
 
 Package developers can specify in package recipes the
 @uref{https://nvd.nist.gov/cpe.cfm,Common Platform Enumeration (CPE)}
-name and version of the package when they differ from the name that Guix
-uses, as in this example:
+name and version of the package when they differ from the name or version
+that Guix uses, as in this example:
 
 @example
 (package
   (name "grub")
   ;; @dots{}
   ;; CPE calls this package "grub2".
-  (properties '((cpe-name . "grub2"))))
+  (properties '((cpe-name . "grub2")
+                (cpe-version . "2.3")))
+@end example
+
+Sometimes, the CVE database contains false positives.  Package developers who
+found CVE alerts and verified they can be ignored can declare them as in
+this example:
+
+@example
+(package
+  (name "t1lib")
+  ;; @dots{}
+  ;; These CVEs are false positives and can be ignored:
+    (properties `((lint-hidden-cve . ("CVE-2011-0433"
+                                     "CVE-2011-1553"
+                                     "CVE-2011-1554"
+                                     "CVE-2011-5244")))))
 @end example
 
 @item formatting
-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[bug#31437] [PATCH 2/2] gnu: opencv: Ignore CVEs.

[Björn Höfling]

[-- Attachment #1: Type: text/plain, Size: 1075 bytes --]


* gnu/packages/image-processing.scm (opencv)[properties]:  Add a
lint-hidden-cve property and add three CVEs to be ignored.
---
 gnu/packages/image-processing.scm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gnu/packages/image-processing.scm
b/gnu/packages/image-processing.scm index ef303e134..4842ad450 100644
--- a/gnu/packages/image-processing.scm
+++ b/gnu/packages/image-processing.scm
@@ -222,6 +222,11 @@ integrates with various databases on GUI toolkits
such as Qt and Tk.") (for-each delete-file
                             '("modules/java/test/pure_test/lib/junit-4.11.jar"
                               "samples/java/sbt/sbt/sbt-launch.jar"))))))
+    ;; These three CVEs are not a problem of OpenCV, see:
+    ;; https://github.com/opencv/opencv/issues/10998
+    (properties '((lint-hidden-cve . ("CVE-2018-7712"
+                                      "CVE-2018-7713"
+                                      "CVE-2018-7714"))))
     (build-system cmake-build-system)
     (arguments
      `(#:configure-flags
-- 
2.17.0


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[bug#31437] [PATCH 1/2] doc: Update documentation of guix lint

[Ludovic Courtès]

Hello,

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> * doc/guix.texi (Invoking guix lint): Add cpe-version to example.
> * doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.

I reworded the bit about ‘lint-hidden-cve’, mostly so that packagers
don’t start using it without a very good reason ;-), and committed.

Thanks!

Ludo’.

bug#31437: [PATCH 2/2] gnu: opencv: Ignore CVEs.

[Ludovic Courtès]

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> skribis:

> * gnu/packages/image-processing.scm (opencv)[properties]:  Add a
> lint-hidden-cve property and add three CVEs to be ignored.

Applied, thanks!