Merge ~litios/ubuntu-cve-tracker:customer_ppas/cve_triage_no_cve into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

If the subproject doesn't require CVE triage, don't create the CVE file.

Testing: https://pastebin.canonical.com/p/MKb3v9823V/

[Simon Quigley (tsimonq2)]

I realize this is a customer-driven diff, but if possible, since this is a public code base, could you provide some (redacted), public-facing testing instructions?

This has no impact on whether it is merged or not, but I'm just curious.

Thanks.

[David Fernandez Gonzalez (litios)]

> I realize this is a customer-driven diff, but if possible, since this is a
> public code base, could you provide some (redacted), public-facing testing
> instructions?

Sure! To test this change you need to:

1. Create a 'subprojects' folder in the root of ubuntu-cve-tracker and, inside this new one, another folder with the name of your subproject.
2. Populate config.yml inside the subproject as needed by `load_external_subprojects` function in cve_lib. You need to provide all the mandatory fields.
3. Run scripts/check-syntax to verify that the tool alerts about a missing CVE when cve_triage is set to true and that it doesn't if false.

> This has no impact on whether it is merged or not, but I'm just curious.
>
> Thanks.

[Alex Murray (alexmurray)]

I don't think the name `cve_triage` accurately reflects the purpose - also this is a change to check_syntax which doesn't create any CVEs, so I am not sure the commit description is accurate either.

Should this instead be called `required` or `requires_cves` or something else?

[Emilia Torino (emitorino)]

> I don't think the name `cve_triage` accurately reflects the purpose - also
> this is a change to check_syntax which doesn't create any CVEs, so I am not
> sure the commit description is accurate either.
>
> Should this instead be called `required` or `requires_cves` or something else?

Maybe requires_cves_triage? Since there is a related cve_patching config

26bff98... by David Fernandez Gonzalez on 2023-11-17

Don't add CVE entries if cve_triage is false

For those subprojects where the customer doesn't require CVE triage,
(that means cve_triage: false in config.yml), we shouldn't add any
entries. Those CVE files shouldn't exist in the subproject directory.

Signed-off-by: David Fernandez Gonzalez <email address hidden>

[David Fernandez Gonzalez (litios)]

Thanks for the feedback! I updated active_edit and created an appropriate function.

Regarding the naming, I don't have a strong preference either way, but I feel like changing that key name should be a different PR.

Let me know if you don't agree with something :)

[Eduardo Barretto (ebarretto)]

lgtm, thanks!

review: Approve

diff --git a/scripts/active_edit b/scripts/active_edit
index d9068d6..2b46b07 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -138,6 +138,10 @@ def _add_pkg(p, fp, fixed, parent, embargoed):
             elif pkgs_from_generic:
                 pkgs_to_add = pkgs_from_generic
 
+            # If the subproject doesn't require cve triage,
+            # we shouldn't add any entries to the CVE
+            if not cve_lib.is_cve_triage_required(rel): continue
+
             for pkg in pkgs_to_add:
                 rel_pkgname = rel + '/' + pkg
                 if not rel_pkgname in added_rel_pkg:
diff --git a/scripts/check-syntax b/scripts/check-syntax
index 6a27d5e..734aa04 100755
--- a/scripts/check-syntax
+++ b/scripts/check-syntax
@@ -540,6 +540,11 @@ def check_cve(cve):
             # only warn on active CVEs
             if is_active(cve) and \
                rel in source and pkg in source[rel]:
+                
+                # If the subproject doesn't require cve triage,
+                # we shouldn't add any entries to the CVE
+                if not cve_lib.is_cve_triage_required(rel): continue
+
                 filename = srcmap["pkgs"][pkg][nearby_rel][0]
                 linenum = srcmap["pkgs"][pkg][nearby_rel][1]
                 print(
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index 01ffd2e..0ff90e3 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -898,6 +898,17 @@ def get_subproject_description(rel):
 
     return description
 
+def is_cve_triage_required(rel):
+    """Check if CVE triage is required for a given release"""
+    if rel not in external_releases:
+        return True
+    
+    try:
+        _,_,_,details = get_subproject_details(rel)
+        return details['support_metadata']['cve_triage']
+    except KeyError:
+        # Taking the safe option here
+        return True
 
 def get_external_subproject_cve_dir(subproject):
     """Get the directory where CVE files are stored for the subproject.