GNU bug report logs - #31437
[PATCH 0/2] opencv: Ignore CVEs. Document lint-hidden-cve

Previous Next

Full log

View this message in rfc822 format

From: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
To: 31437 <at> debbugs.gnu.org
Subject: [bug#31437] [PATCH 1/2] doc: Update documentation of guix lint
Date: Sun, 13 May 2018 01:40:00 +0200

[Message part 1 (text/plain, inline)]

* doc/guix.texi (Invoking guix lint): Add cpe-version to example.
* doc/guix.texi (Invoking guix lint): Add example for lint-hidden-cve.
---
 doc/guix.texi | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 637c9c3f4..f0b666b9e 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -6835,15 +6835,31 @@ where @code{CVE-YYYY-ABCD} is the CVE identifier---e.g.,
 
 Package developers can specify in package recipes the
 @uref{https://nvd.nist.gov/cpe.cfm,Common Platform Enumeration (CPE)}
-name and version of the package when they differ from the name that Guix
-uses, as in this example:
+name and version of the package when they differ from the name or version
+that Guix uses, as in this example:
 
 @example
 (package
   (name "grub")
   ;; @dots{}
   ;; CPE calls this package "grub2".
-  (properties '((cpe-name . "grub2"))))
+  (properties '((cpe-name . "grub2")
+                (cpe-version . "2.3")))
+@end example
+
+Sometimes, the CVE database contains false positives.  Package developers who
+found CVE alerts and verified they can be ignored can declare them as in
+this example:
+
+@example
+(package
+  (name "t1lib")
+  ;; @dots{}
+  ;; These CVEs are false positives and can be ignored:
+    (properties `((lint-hidden-cve . ("CVE-2011-0433"
+                                     "CVE-2011-1553"
+                                     "CVE-2011-1554"
+                                     "CVE-2011-5244")))))
 @end example
 
 @item formatting
-- 
2.17.0

[Message part 2 (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.