Merge ~canonical-kernel-team/ubuntu-cve-tracker:kcve-merge-separate into ubuntu-cve-tracker:master

[Yuxuan Luo]

In the previous approach, kcve-merge format one single commit gathering all the changes if multiple CVE IDs are given, which is not friendly for reviewing. This patch change the behavior to always generating separate patches for each CVE.

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

I haven't really used the script, but I have played with it before and also
again with this proposed change.
Anyway, I'm totally onboard for single commits per CVE for a better picture
(and control) of what is being changed.
It also helps me, personally, when reviewing what is being changed with the
autotriage.

Appreciate the changes!

review: Approve

[Seth Arnold (seth-arnold)]

This looks like a good idea to me, thanks.

review: Approve

[Steve Beattie (sbeattie)]

On Wed, Feb 07, 2024 at 05:30:33PM -0000, Yuxuan Luo wrote:
> Commit message:
> In the previous approach, kcve-merge format one single commit gathering all the changes if multiple CVE IDs are given, which is not friendly for reviewing. This patch change the behavior to always generating separate patches for each CVE.

LGTM, merged.

One minor point, not even a nit and not introduced by this merge
request:

> + try:
> + cve_lib.git_commit("kernel/" + cve_path.split(sep="/")[-1] + ": autotriage")

os.path.basename(cve_path) could be used instead of
cve_path.split(sep="/")[-1] to identify the CVE for the commit
message subject.

--
Steve Beattie
<email address hidden>

diff --git a/scripts/kcve-merge b/scripts/kcve-merge
index 9897b1d..3fd3de7 100755
--- a/scripts/kcve-merge
+++ b/scripts/kcve-merge
@@ -284,23 +284,19 @@ def main():
                                 continue
                 print(line, end='')
 
-    # Prepare for git push
-    git_status = subprocess.run(["git", "status", "--short"], capture_output=True).stdout.decode()
-    if len(git_status) == 0:
-        warn('No changes being made')
-    else:
-        for cve_num in cve_path_list:
+        # Prepare for git push
+        git_status = subprocess.run(["git", "status", "--short"], capture_output=True).stdout.decode()
+        if len(git_status) == 0:
+            warn('No changes being made')
+        else:
             try:
-                cve_lib.git_add(cve_num)
+                cve_lib.git_add(cve_path)
             except ValueError as e:
                 error(e)
-        try:
-            if len(cve_path_list) == 1:
-                cve_lib.git_commit("kernel/" + cve_path_list[0].split(sep="/")[-1] + ": autotriage")
-            else:
-                cve_lib.git_commit("kernel: autotriage")
-        except ValueError as e:
-            error(e.args[0])
+            try:
+                cve_lib.git_commit("kernel/" + cve_path.split(sep="/")[-1] + ": autotriage")
+            except ValueError as e:
+                error(e.args[0])
 
 
 if __name__ == '__main__':