aboutsummaryrefslogtreecommitdiffstats
path: root/lib/MGA/Advisories.pm
Commit message (Collapse)AuthorAgeFilesLines
* Show a hint if an SRPM can't be found in non-coreDan Fandrich2025-04-021-0/+3
| | | | | If the RPM name is missing a .nonfree or .tainted suffix, warn the user that this might be the reason.
* Don't always reset a "modified" value in the status fileDan Fandrich2025-02-241-1/+2
| | | | | The modified value starts off from SVN, but if a more recent value is found in the status file, use that instead.
* Read advisories from disk in parallelDan Fandrich2024-12-061-9/+28
| | | | | | The parsing overhead is now spread over multiple cores when available, dramatically reducing the time to read them all. mgaadv list is twice as fast now on one test machine, for example.
* Ensure the .adv file ends with newline when publishingDan Fandrich2024-04-161-0/+11
| | | | | Lacking a newline corrupts the file when the ID is appended. Return an error if this case is detected.
* Get the last modified date of advisories from SVNDan Fandrich2024-04-161-1/+29
| | | | | | | | | The modification date helps track if an advisory was changed after initial publication. This is especially important for OSV users who need the modification date in the vulns.json index to determine whether an existing advisory was updated so they can download the update. Also, keep "ref" (pointing to bug number) in all advisories, not just the TODO ones.
* Try to fix publish-allDan Fandrich2024-04-161-1/+1
| | | | | An argument to output_pages() was missing. This command probably never worked.
* Exit if any of the parallel processes return an errorDan Fandrich2024-03-211-1/+10
|
* Cross-check that at least one SRPM is listed in the advisoryDan Fandrich2024-03-211-0/+4
| | | | An advisory must come with at least one fixed package.
* Use multiprocessing in mksite for improved speedDan Fandrich2024-03-191-20/+68
| | | | | | | | | | This generates templated files using some parallelism, reducing the total mksite time to less than half in my tests. Increasing parallelism even further is possible, but would make the code harder to understand. The obvious technique of generating each templated file in its own process is actually far slower because the overhead of process creation dwarfs the time spent processing the template, which is on average very small and quick.
* Write JSON index files for advisoriesDan Fandrich2024-03-141-0/+2
| | | | | | The JSON schema is simple and compatible with the one published in the Go Vulnerability Database. Security advisories and bugfix advisories each have their own index.
* Write JSON output files in mksiteDan Fandrich2024-03-081-0/+2
|
* Add 'showjson' command to output an advisory in OSV JSONDan Fandrich2024-03-081-0/+23
| | | | | | Open Source Vulnerability format is a standard for publishing vulnerabilities in Open Source projects and is defined at https://ossf.github.io/osv-schema/
* Report the broken file rather than exploding when an advisory is invalidPascal Terjan2020-11-081-1/+9
|
* Reset 'advisory' keyword instead of 'validated_update' for invalid advisoriesRémi Verschelde2017-09-201-2/+2
| | | | | This is now possible since 'advisory' was made a keyword, while it used to be written in the Whiteboard field.
* use https in links to advisoriesThomas Backlund2016-04-081-1/+1
|
* Add URL to descriptionsPascal Terjan2016-02-291-0/+1
|
* Add missing 'the' articleShlomi Fish2015-04-241-1/+1
|
* Add functions useful to generate update descriptionsPascal Terjan2015-03-151-0/+27
|
* Add [name] argument to mgaadv to prefill the templateRémi Verschelde2014-11-301-1/+2
|
* Print out the bug link when processing advisories.Colin Guthrie2014-11-251-1/+1
| | | | | I'm forever missing this information and having to manually find which advisory I'm actually looking at, let's just print it out.
* Ensure we're in the advisory dir before running svn commands.Colin Guthrie2014-11-251-2/+4
|
* Add option to post to bugzilla during ID assignment.Colin Guthrie2014-11-251-2/+21
| | | | | | Allow the operator to optionally post to Bugzilla (and remove the validated_update keyword) if the id assignment fails during cross checks.
* Add support for authenticated bugzilla in QA mode.Colin Guthrie2014-11-251-4/+33
| | | | | | This will allow QA team to post automated messages to BZ when trying to assign IDs and the cross check fails for whatever reason (typically deependent bugs or SRPM check failures).
* Buffer up our checklist text so we can use it later.Colin Guthrie2014-11-251-17/+31
| | | | The intention is to post this to bugzilla.
* Add a 'publishall' option to attempt to publish all pending advisories.Colin Guthrie2014-11-251-0/+24
|
* Allow overriding of dependent bug check.Colin Guthrie2014-10-071-1/+19
| | | | | | | | | | | | | | | | | Sometimes a batch of updates will contain some updates dependent on other updates to be pushed at the same time. Until the update is actually pushed, the bug will not be closed. Thus a chicken and egg scenario. While we could evaluate which bugs are in the update queue to be processed and make sure we process them first and add them to an internal whitelist, this would require talking to bugzilla for all bugs first, then processing them. This approach is definitely possible and desirable and when a 'process-all' verb is added, this will likely be done. But in the short term, deferring to the user is easier!
* Fix bugnum regexp for '12345.mga4' type advisory namesColin Guthrie2014-08-211-3/+2
|
* Add check to highlight that the first reference must be the MGA advisory bugColin Guthrie2014-08-211-0/+4
|
* Check that SRPMs exist when publishing updates.Colin Guthrie2014-08-121-1/+23
| | | | This is thanks to a small, but simple API available via http://repository.mageia.org/
* Remove redundant text from report log message.Colin Guthrie2014-08-121-1/+1
|
* Close bugs in order.Colin Guthrie2014-08-061-1/+1
| | | | | Very minor issue but we may as well close the bugs in order of advisory.
* Add support for automatically committing advisories after assigning ID.Colin Guthrie2014-08-061-0/+50
| | | | | This currently integrates with subversion, but it will be trivial to switch it to git.
* Attempt to force ordering of emails when delivering severalColin Guthrie2014-08-061-0/+2
|
* Close bugs automatically when processing advisoriesColin Guthrie2014-08-061-0/+33
| | | | mga#13859
* When assigning an advisory ID, make sure the first reference is to advisory bug.Colin Guthrie2014-08-061-3/+12
| | | | mga#13859
* Drop cookie support for bugzilla.Colin Guthrie2014-08-061-22/+9
| | | | | | | | | | | | | Apparently this no longer works with BZ 4.4 and it now relies on a token to authenticate future requests. We now maintain this token and ensure we pass it in with future requests. Also strip of the xmlrpc.cgi part of the BZ URL so we can use it to validate bug URLs in the future. mga#13859
* Perform some cross checks via bugzilla when publishing advisoriesColin Guthrie2014-08-051-5/+170
|
* Add a log entry when moving packages.Colin Guthrie2014-08-051-0/+1
|
* Fix trailing whitespaceColin Guthrie2014-08-051-1/+1
|
* Add a new command to move the packages.Colin Guthrie2014-08-031-0/+30
| | | | | This shells out to a separate command that actually implements this. Such a tool exists already in mgatools called 'mga-move-pkg'
* Publish and Email advisories in order.Colin Guthrie2014-08-031-2/+2
| | | | This should mean that emails are sent out in sequential order
* Fix perl warning when invalid SRPM name is found.Colin Guthrie2014-08-031-3/+6
|
* Rename index.html to infos.html and advisories.html to index.htmlNicolas Vigier2013-09-091-0/+1
|
* Set ENCODING when creating templatesNicolas Vigier2013-07-211-0/+5
|
* Allow specifying .adv extension with the publish commandNicolas Vigier2013-07-211-0/+1
|
* Set template output to utf8Nicolas Vigier2013-07-161-1/+3
|
* Split long lineNicolas Vigier2013-06-261-1/+2
|
* next_id: sort IDs numericallyNicolas Vigier2013-06-261-1/+1
|
* Add support for filters on list commandNicolas Vigier2013-06-171-3/+12
| | | | | | | | | Possible filters are : - advisory type - distribution release - package name - CVE - media
* Don't save status for unpublished advisoriesNicolas Vigier2013-06-171-0/+3
|
generated by cgit v1.2.1 (git 2.21.0) at 2025-12-20 01:07:25 +0000