GNU logs - #47188, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#47188: "guix lint -c cve" does not account for language prefixes (rust-,python-,go-,..)
Resent-From: =?UTF-8?Q?L=C3=A9o?= Le Bouter <lle-bout@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 16 Mar 2021 09:30:02 +0000
Resent-Message-ID: <handler.47188.B.161588699522966 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 47188 <at> debbugs.gnu.org
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.zaclys.net 12G9TmkD029553
Message-ID: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
From: =?UTF-8?Q?L=C3=A9o?= Le Bouter <lle-bout@HIDDEN>
Date: Tue, 16 Mar 2021 10:29:43 +0100
Content-Type: multipart/signed; micalg="pgp-sha512";
 protocol="application/pgp-signature"; boundary="=-bI67y0ZTY2dX0rtN6Z0z"
User-Agent: Evolution 3.34.2 
MIME-Version: 1.0
Received-SPF: pass client-ip=178.33.93.72; envelope-from=lle-bout@HIDDEN;
 helo=mail.zaclys.net
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)


--=-bI67y0ZTY2dX0rtN6Z0z
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

./pre-inst-env guix lint -c cve python-urllib3@HIDDEN
Here this should return at least CVE-2021-28363 but it does not because
the CVE database contains urllib3 and not python-urllib3 (which AFAICT
the cve linter searches for).

Annotating each and every python-, go-, and rust- package with cpe-name=20
properties is going to be very annoying. I suggest we add some
heuristics that try both the full name and prefix-trimmed name. python-
urllib3's cpe name and vendor is python (vendor) urllib3 (name).

Same story for CVE-2021-28305 and rust-diesel, though it doesnt even
have a CPE entry yet.

--=-bI67y0ZTY2dX0rtN6Z0z
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBQeocACgkQRaix6GvN
EKYwbRAAvxOJo9PUoxYyYGmQHbp+QgOBwdzrPBLxZs/rCRiyOW5pf8//By8pIKFR
ux0nKH92TNB3pLyWuAvwd+IvEGBeaAgFAPjXHhHkRoY/ywCdAam5BaBWmigdYd5P
qcAc9CDJTjHrZTU43SG5NbXN/9xxeGrePLEs12PDN4nYUf+7G5qdYEEuaxn/pCTn
T/+2gL2734IvnAOvWLMwcevi1v+brnrJDuC3s2jJxfCV4NCeAcBfyEDtqgiR5R4t
Ci46fjiVn4IbHfeMKB0gT3cs3xdeEsThaBFfB1Bd8MLy61PD/2ihHkmxWjm06FrT
ojjwUydPa5/VwEIfUJJRiLmb2EyhJRAyTaJRBkQNQsTmipd3kz8uQVPEsgIa0u0W
dDcUPtCoDn3f9QLmZSUAZ3RbHsR/PaeXkidGv26Gwk2un7ctwlY9vM4oo5LbUS4F
X6Ljr5xUAbh3VzD5bfnHfCaImIahXK5m/Jsmd+C78ubwcU0DszWwqY571jq3Vg8j
9IPFNH7DMtg+ffEkqUUTZgMVAP8Xdm4KAvca2Ra7XqzxaHQphmofE0YgFFw36lod
+Hdyg95hp8KRPnlhfU6EYopoMTdZwyOyFEHG08TS4GC7WKR+UOpZ4j19WDNMEt6Z
uyKeHI9kcoJaIQ1genGKkv0BtAE18Fz1XWSgybsks4OSU0Ow8zA=
=j6lI
-----END PGP SIGNATURE-----

--=-bI67y0ZTY2dX0rtN6Z0z--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: =?UTF-8?Q?L=C3=A9o?= Le Bouter <lle-bout@HIDDEN>
Subject: bug#47188: Acknowledgement ("guix lint -c cve" does not account
 for language prefixes (rust-,python-,go-,..))
Message-ID: <handler.47188.B.161588699522966.ack <at> debbugs.gnu.org>
References: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
X-Gnu-PR-Message: ack 47188
X-Gnu-PR-Package: guix
Reply-To: 47188 <at> debbugs.gnu.org
Date: Tue, 16 Mar 2021 09:30:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 47188 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
47188: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D47188
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#47188: "guix lint -c cve" does not account for language prefixes (rust-, python-, go-, ..)
Resent-From: zimoun <zimon.toutoune@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 16 Mar 2021 13:06:02 +0000
Resent-Message-ID: <handler.47188.B47188.161589993223161 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: =?UTF-8?Q?L=C3=A9o?= Le Bouter <lle-bout@HIDDEN>
Cc: 47188 <at> debbugs.gnu.org
MIME-Version: 1.0
References: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
In-Reply-To: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
From: zimoun <zimon.toutoune@HIDDEN>
Date: Tue, 16 Mar 2021 14:05:13 +0100
Message-ID: <CAJ3okZ2yHtxtbi0vhskAJCCWT_NkQuOUnLof9cm7MRDwpeAkug@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi,

On Tue, 16 Mar 2021 at 10:30, L=C3=A9o Le Bouter via Bug reports for GNU
Guix <bug-guix@HIDDEN> wrote:

> ./pre-inst-env guix lint -c cve python-urllib3@HIDDEN
> Here this should return at least CVE-2021-28363 but it does not because
> the CVE database contains urllib3 and not python-urllib3 (which AFAICT
> the cve linter searches for).

Does the CVE use the upstream name?  Or a normalized name?

I mean, in the R world, packages can have names as 'org.EcK12.eg.db'
which becomes "r-org-eck12-eg-db".  To easy the mapping for updating
and co, the package definition contains:

    (properties
     `((upstream-name . "org.EcK12.eg.db")))

Maybe, it could be worth to have similar things.  WDYT?


All the best,
simon

Message sent to bug-guix@HIDDEN:

Subject: bug#47188: "guix lint -c cve" does not account for language prefixes (rust-,python-,go-,..)
Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 18 Mar 2021 13:27:02 +0000
Resent-Message-ID: <handler.47188.B47188.161607399130217 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: =?UTF-8?Q?L=C3=A9o?= Le Bouter <lle-bout@HIDDEN>
Cc: 47188 <at> debbugs.gnu.org
From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
References: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
Date: Thu, 18 Mar 2021 14:26:18 +0100
In-Reply-To: <706d51950b7545eefd43a54f738bc82df0d7f36c.camel@HIDDEN>
 ("=?UTF-8?Q?L=C3=A9o?=
 Le Bouter"'s message of "Tue, 16 Mar 2021 10:29:43 +0100")
Message-ID: <87a6r0r3t1.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi,

L=C3=A9o Le Bouter <lle-bout@HIDDEN> skribis:

> ./pre-inst-env guix lint -c cve python-urllib3@HIDDEN
> Here this should return at least CVE-2021-28363 but it does not because
> the CVE database contains urllib3 and not python-urllib3 (which AFAICT
> the cve linter searches for).
>
> Annotating each and every python-, go-, and rust- package with cpe-name=20
> properties is going to be very annoying. I suggest we add some
> heuristics that try both the full name and prefix-trimmed name. python-
> urllib3's cpe name and vendor is python (vendor) urllib3 (name).
>
> Same story for CVE-2021-28305 and rust-diesel, though it doesnt even
> have a CPE entry yet.

Yes, that=E2=80=99s an issue.  We can address these by adding a =E2=80=98cp=
e-name=E2=80=99
property (info "(guix) Invoking guix lint"), but that=E2=80=99s going to be
tedious.  We can at least add it to high-profile packages for now.

Tooling that suggests or deduces the CPE name would help a lot:

  https://issues.guix.gnu.org/42299

Ludo=E2=80=99.

Message received at control <at> debbugs.gnu.org:

Received: (at control) by debbugs.gnu.org; 18 Mar 2021 13:38:54 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Mar 18 09:38:54 2021
Received: from localhost ([127.0.0.1]:45408 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1lMsrW-0001s0-Ds
	for submit <at> debbugs.gnu.org; Thu, 18 Mar 2021 09:38:54 -0400
Received: from eggs.gnu.org ([209.51.188.92]:52124)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@HIDDEN>) id 1lMsrU-0001rl-V8
 for control <at> debbugs.gnu.org; Thu, 18 Mar 2021 09:38:53 -0400
Received: from fencepost.gnu.org ([2001:470:142:3::e]:55044)
 by eggs.gnu.org with esmtp (Exim 4.90_1)
 (envelope-from <ludo@HIDDEN>) id 1lMsrP-0008OB-Nx
 for control <at> debbugs.gnu.org; Thu, 18 Mar 2021 09:38:47 -0400
Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=53192 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@HIDDEN>) id 1lMsrN-0008Bl-TW
 for control <at> debbugs.gnu.org; Thu, 18 Mar 2021 09:38:46 -0400
Date: Thu, 18 Mar 2021 14:38:44 +0100
Message-Id: <877dm4ponv.fsf@HIDDEN>
To: control <at> debbugs.gnu.org
From: =?utf-8?Q?Ludovic_Court=C3=A8s?= <ludo@HIDDEN>
Subject: control message for bug #47188
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: control
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

tags 47188 + security
quit

Last modified: Thu, 18 Mar 2021 13:45:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.