Make klp-build reliably detect is a specific tag/rpm already has the patch that fixes a specific CVE

[marcosps]

What we currently have

This is the workflow that we use to detect if a codestream is vulnerable or not:

• Get the commit hash of the fix for the current codestream, e.g SLE15-SP6
• Check for all tags that contain that specific commit
  • These codestreams are are not vulnerable
• Check for the CVE number on git-log of a specific codestream (git tag per kernel released)
  • If the CVE is mentioned it means that the specific codestream is not vulnerable, since the patch that fixes it is present on the kernel being checked

But what if the patch that fixes the CVE was backported pro-actively and thus doesn't mention the CVE?

Other approaches

Idea	Problem
Check the Git-commit tag on the patch file of the git-tag related to the codestreams	Problem: Couldn't find a way of executing git-grep on a codestream without using git-checkout to switch to the tag

Combining the git-grep approach would make things more reliable.

[fgyanz]

Hi @marcosps,

I created a branch implementing the proposed idea, in case anyone wants to try it out. I've been testing it so far and seems to work fine, but ofc, that's only assuming we don't encounter a case as the one described in the "Problem" column.

kind regards, Fernando

[marcosps]

@fgyanz please send a PR for your branch so we can test and merge it. But as you mentioned, this doesn't fix the issue that I'm seeing: codestreams that were already released and contain the fix backported, but without the CVE number, meaning that the CVE number was created after the patch was backported and tag created.

Either way we can extend the check later for such cases!

[marcosps]

Update the original issue to mention a new idea.

[marcosps]

I believe that we currently have in hand everything that we need in order to correct detect if a codestream is vulnerable or not. I was wrong when I thought we werent.

In the case that we have a patch already applied before the CVE entry was created, klp-build would first check which codestream family (SLE12-SP5, SLE15-SP2, ...) has backports, and then check the specific codestreams themselves (12.5u48, 12.5u49, 15.5u10, 15.5u20, ..), so in this case, if a codestream already contains the fix, there won't be any backports done to the codestream families, so we are covered.

With it I believe that we can close this issue. Good work @fgyanz for implementing the last missing piece of the checking code!