Merge ~alexmurray/ubuntu-security-tools:umt-check-warn-missing-cve-lp-bugs into ubuntu-security-tools:master

[Alex Murray]

Add new functionality to umt check so that for each CVE referenced in the debian/changelog entry, check for any Bugs: entries from the CVE file for launchpad bugs which are not mentioned in the changelog itself.

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

Nice update, thanks for that :)
Just left a little comment, but if someone else approves it, please don't bother with that.

[Seth Arnold (seth-arnold)]

I like Rodrigo's idea but there's several hundred entries in UCT with 'short' launchpad URLs:

± rg https://launchpad.net/bugs/1 | wc -l
803

It'd be nice to be a bit tighter than just 'launchpad'; 'launchpad.*bug' seems to work to catch cases like:

https://bugs.edge.launchpad.net/ubuntu/+source/lynx-cur/+bug/613254
https://bugs.launchpad.net/bugs/1570694
https://bugs.launchpad.net/qemu/+bug/1914353
https://bugs.launchpad.net/ubuntu/+source/mapserver/+bug/617489
https://launchpad.net/bugs/999359

Is adding regex here okay?

Thanks

[Alex Murray (alexmurray)]

Good idea re a regex sarnold - let me know what you think of https://git.launchpad.net/~alexmurray/ubuntu-security-tools/commit/?id=05054be937715b8b49f43b52fda0f4e96ea74aa6

[Seth Arnold (seth-arnold)]

I like it :) thanks

review: Approve

diff --git a/build-tools/umt b/build-tools/umt
index ee74cbe..3c33569 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -912,6 +912,20 @@ def cmd_check():
         if not releases or details['release'] in releases:
             warn(warning)
 
+    # finally check changes file as well for missing LP: # references
+    changes_file = dscfile.replace(".dsc", "_source.changes")
+    details = parse_changes_file(changes_file)
+    lpbug_re = re.compile("https?://(bugs\\.)?(edge\\.)?launchpad\\.net/(bugs|[a-z0-9+/-]+)/([0-9]+)")
+    for cve in details["cves"]:
+        cvefile = source_map.cve_lib.find_cve(cve)
+        data = source_map.cve_lib.load_cve(cvefile)
+        for line in data["Bugs"].splitlines():
+            m = lpbug_re.search(line)
+            if m is not None:
+                bug = m[4]
+                if 'bugs' not in details or bug not in details['bugs']:
+                    warn(cve + ' references launchpad bug LP: #' + bug + ' but this is missing from debian/changelog')
+
     # return check-source-package error code
     if rc != 0:
         sys.exit(rc)
@@ -4104,6 +4118,8 @@ def parse_changes_file(changes_file):
             else:
                 details['distribution'] = line.strip().split()[1]
                 details['pocket'] = 'release'
+        elif re.search('^Launchpad-Bugs-Fixed:', line) and 'bugs' not in details:
+            details['bugs'] = line.strip().split()[1:]
         else:
             cves = re.findall(r'\bCVE-[0-9]{4}-[0-9]+\b', line)
             if cves: