Merge ~alexmurray/ubuntu-cve-tracker:try-lookup-kernel-cves-from-local-repo into ubuntu-cve-tracker:master

[Alex Murray]

scripts/cve_lib.py: try looking up kernel commits from local git clone

First try and look up kernel git commit details from the locally configured
linux_kernel_path (this is already used in the kernel CVE triage scripts) and
then fallback to pulling down the individual commit via the network if that
fails.

This should speed up these operations when a local git repo exists is configured
AND has the relevant commits.

Tested with a simple example:

$ grep linux_kernel_path ~/.ubuntu-cve-tracker.conf
$ time ./scripts/active_edit -p linux -c CVE-2025-00001 -k -r https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760

real 0m6.611s
user 0m6.115s
sys 0m0.054s

$ sed -i s/'#linux_kernel_path'/'linux_kernel_path'/ ~/.ubuntu-cve-tracker.conf
$ time ./scripts/active_edit -p linux -c CVE-2025-00002 -k -r https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760

real 0m6.173s
user 0m6.105s
sys 0m0.066s

$ diff active/CVE-2025-0000{1,2}
1c1
< Candidate: CVE-2025-00001
---
> Candidate: CVE-2025-00002
4c4
< https://www.cve.org/CVERecord?id=CVE-2025-00001
---
> https://www.cve.org/CVERecord?id=CVE-2025-00002

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

LGTM.
Thanks for this, was wanting something like that for a while.
Ran a few tests on my side and it is working fine!

review: Approve

diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index f8cff79..c522742 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -3618,6 +3618,21 @@ def wrap_text(text, width=75):
     """
     return wordwrap(text, width).replace(' \n', '\n')
 
+def git_cmd(command, commit, repo=os.getcwd()):
+    rc, report = cmd(['git', '-C', repo, command, commit])
+    if rc != 0:
+        print(report, file=sys.stderr)
+        return None
+    return report
+
+def git_show(commit, repo=os.getcwd()):
+    '''Look up a commit from a local git clone.'''
+    return git_cmd('show', commit, repo)
+
+def git_revparse(commit, repo=os.getcwd()):
+    '''Run git rev-parse on a local git clone.'''
+    return git_cmd('rev-parse', commit, repo)
+
 def fetch_kernel_fixes(url):
     '''Downloads a kernel commit and returns a list of break-fixes'''
     commit_hash = None
@@ -3642,12 +3657,23 @@ def fetch_kernel_fixes(url):
     # Get the raw patch
     url = url.replace('/commit/', '/patch/')
 
+    # first try from local git repo
+    patch = None
+    config = read_uct_config()
     try:
-        with urllib.request.urlopen(url) as response:
-            patch = response.read().decode('utf-8')
-    except urllib.error.HTTPError as e:
-        print("WARNING: Failed to fetch patch URL %s: %s" % (url, str(e)), file=sys.stderr)
-        return fixes
+        commit = url.rsplit('=', maxsplit=1)[1]
+        patch = git_show(commit, config["linux_kernel_path"])
+    except KeyError:
+        # no linux_kernel_path configured - TODO warn user?
+        pass
+    finally:
+        if patch is None:
+            try:
+                with urllib.request.urlopen(url) as response:
+                    patch = response.read().decode('utf-8')
+            except urllib.error.HTTPError as e:
+                print("WARNING: Failed to fetch patch URL %s: %s" % (url, str(e)), file=sys.stderr)
+                return fixes
 
     backport_re = re.compile(r"(commit [0-9a-f]{40} upstream.|\[ Upstream commit [0-9a-f]{40} \])")
     for line in patch.split("\n"):
@@ -3657,7 +3683,7 @@ def fetch_kernel_fixes(url):
         if backport_re.match(line):
             # This is an LTS backport, skip it
             return []
-        if not commit_hash and line.startswith("From "):
+        if not commit_hash and line.startswith("From ") or line.startswith("commit "):
             commit_hash = line.split(' ')[1]
             continue
         elif line.startswith("Fixes: "):
@@ -3695,6 +3721,15 @@ def get_long_kernel_hash(short_hash):
     if len(short_hash) > 12 and INITIAL_COMMIT_HASH.startswith(short_hash):
         return INITIAL_COMMIT_HASH
 
+    commit_hash = None
+    config = read_uct_config()
+    try:
+        commit_hash = git_revparse(short_hash, config["linux_kernel_path"])
+    except KeyError:
+        pass
+    if commit_hash and commit_hash.startswith(short_hash):
+        return short_hash.strip()
+
     url = 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=' + short_hash
     with urllib.request.urlopen(url) as response:
         try: