Closed gotmax23 closed 2 years ago
Thanks for the report - appreciate it
(You are right - I think currently fbrnch wrongly assumes only one bz mention per changelog line: that shouldn't be so hard to fix)
I guess ideally we should read the severity from the CVE bug... but that is a little stretch, though the CVE reference might help there. Also CVEs usually include a bodhi template, which the next release will support: see 8ad28ff. Probably easiest and useful to add an option for this anyway.
(You are right - I think currently fbrnch wrongly assumes only one bz mention per changelog line: that shouldn't be so hard to fix)
That is done in 3b5ba90
Description
Currently,
fbrnch build -u security
does not work properly, as it is impossible to set the Bodhi update severity.Version
I rebuilt the fbrnch rpm with the current git HEAD (https://github.com/juhp/fbrnch/commit/11edd24d10335c4366da8e60543df90f80204f03).
Steps to reproduce
Actual Results
``` Update to 1.1.4 (rhbz#2068719). Mitigates CVE-2022-24778 (rhbz#2069368, ``` Press Enter to use above or input update summary now: Update to 1.1.4 (rhbz#2068719). Mitigates CVE-2022-24778 (rhbz#2069368, rhbz#2069369)
Creating Bodhi Update for golang-github-containerd-imgcrypt-1.1.4-1.fc36: Usage: bodhi updates new [OPTIONS] BUILDS_OR_TAG Try 'bodhi updates new --help' for help.
Error: Invalid value for severity: must specify severity for a security update fbrnch: bodhi updates new --type security --request testing --notes 'Update to 1.1.4 (rhbz#2068719). Mitigates CVE-2022-24778 (rhbz#2069368, rhbz#2069369)' --autokarma --autotime --close-bugs --bugs 2068719 golang-github-containerd-imgcrypt-1.1.4-1.fc36 failed with exit code 2