Merge ~iconstantin/ubuntu-security-tools:master into ubuntu-security-tools:master

[Ian Constantin]

Added a special warning for ghostscript on trusty/xenial/bionic to check that openjpeg patches are for files that compile when ghostscript builds.

ghostscript prior to focal vendors openjpeg - this warning for `umt check` will give an extra notice to check that any changes to openjpeg are to files that are ultimately used/compiled.

[Steve Beattie (sbeattie)]

LGTM, merged. Thanks!

review: Approve

diff --git a/build-tools/umt b/build-tools/umt
index 3c33569..9416371 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -895,6 +895,7 @@ def cmd_check():
                          'eglibc' : [ None, "IMPORTANT: ABI changes may break running daemons! See $QRT/notes-testing/glibc/README" ],
                          'fwupd' : [ None, "IMPORTANT: also needs fwupd-signed updates, and special publishing procedure - talk to infinity" ],
                          'glibc' : [ None, "IMPORTANT: ABI changes may break running daemons! See $QRT/notes-testing/glibc/README" ],
+                         'ghostscript' : [ [ 'trusty', 'xenial', 'bionic' ], "Important: if addressing a CVE in the embedded version of openjpeg, ensure the patches change files that ultimately get compiled" ],
                          'grub2' : [ None, "IMPORTANT: also needs grub2-signed updates, and special publishing procedure - talk to infinity" ],
                          'isc-dhcp' : [ [ 'natty', 'oneiric', 'precise' ], "IMPORTANT: patches at end of 00list file may get reverted at build, see $QRT/build_testing/isc-dhcp!! Also, please include LP: #727837 fix!" ],
                          'json-c' : [ 'xenial', "IMPORTANT: Must test upstart with the updated json-c package! (LP: #1878723)" ],