Merge ~sbeattie/ubuntu-cve-tracker/+git/ubuntu-cve-tracker:cve_need_retire-accept_cves_as_args into ubuntu-cve-tracker:master

[Steve Beattie]

    cve_need_retire: accept an optional list of CVEs to operate on

    Currently, the cve_need_retire script operates on the entire set of
    active CVEs in UCT. However, there are times when it's useful to focus
    on a few CVEs for an update one has just released.

    This commit adds support for optionally taking CVEs as arguments
    (basically accepting whatever the underlying ubuntu-table script
    accepts as CVEs to report on).

    This has been tested with the following commits in UCT:

      commit 8e5d8601a1a4c78f1f6b7aad331faf415608fa71
      Author: Steve Beattie <email address hidden>
      Date: Thu Nov 30 12:53:03 2023 -0800

        Retired 1 CVE

        Packages affected:
          xbmc(1) xine-lib(1) xine-lib-1.2(1)

        Signed-off-by: Steve Beattie <email address hidden>

      commit 96a242723a82be361bde82ef95f9e4e26ce6161c
      Author: Steve Beattie <email address hidden>
      Date: Thu Nov 30 12:52:39 2023 -0800

        Retired 2 CVEs

        Packages affected:
          chromium-browser(2)

        Signed-off-by: Steve Beattie <email address hidden>

    using the following commands:

      ./scripts/cve_need_retire -uc active/CVE-2023-5997 active/CVE-2023-6112
      ./scripts/cve_need_retire -uc CVE-2017-11119

    Also, fix up the shellcheck warning about failing to use read -r
    (and silence what would be an added shellcheck warning around
    un-quote-protected $cves).

Add support to scripts/cve_need_retire for optionally taking CVEs as arguments (basically accepting whatever the underlying ubuntu-table script accepts as CVEs to report on).

[Alex Murray (alexmurray)]

LGTM! Thanks Steve.

review: Approve

diff --git a/scripts/cve_need_retire b/scripts/cve_need_retire
index 1a07359..35bd4be 100755
--- a/scripts/cve_need_retire
+++ b/scripts/cve_need_retire
@@ -4,7 +4,7 @@
 # Author: Kees Cook <[e-mail]>
 # Author: Marc Deslauriers <[e-mail]>
 # Author: Steve Beattie <[e-mail]>
-# Copyright (C) 2005-2020 Canonical Ltd.
+# Copyright (C) 2005-2023 Canonical Ltd.
 #
 # This script is distributed under the terms and conditions of the GNU General
 # Public License, Version 2 or later. See http://www.gnu.org/copyleft/gpl.html
@@ -21,7 +21,7 @@ cvedir="./active"
 
 help() {
     cat <<EOM
-Uasge: cve_need_retire [-f] [-p] [-u]"
+Uasge: cve_need_retire [-f] [-p] [-u] [CVE list]"
 
   -f	full listing
   -r	report (first) package
@@ -29,6 +29,8 @@ Uasge: cve_need_retire [-f] [-p] [-u]"
   -u	move the files to retired directory
   -c	commit the changes to git (requires -u)
   -h	this help statement
+
+A list of CVEs can be given to operate on a subset of the repo
 EOM
 }
 
@@ -37,6 +39,7 @@ update=
 commit=
 path=
 report_pkg=
+cves=
 
 while getopts "fhucpr" opt ; do
     case "$opt" in
@@ -49,6 +52,11 @@ while getopts "fhucpr" opt ; do
         ?) help ; exit 1;;
     esac
 done
+shift $((OPTIND - 1))
+
+if [ "$#" -gt 0 ] ; then
+    cves="$*"
+fi
 
 vcs=bzr
 if [ -d ".git" ]; then
@@ -62,7 +70,11 @@ if [ -n "${commit}" ] && [ -z "${update}" ] ; then
     exit 1
 fi
 
-./scripts/ubuntu-table -r 2>&1 >/dev/null | grep '^retire: ' | while read junk cve
+# don't wrap $cves in quotes because we want it to be ignored if there
+# are none passed, as well as we want the contents to be treated as
+# individual arguments
+# shellcheck disable=SC2086
+./scripts/ubuntu-table -r $cves 2>&1 >/dev/null | grep '^retire: ' | while read -r junk cve
 do
     if [ -z "$full" ]; then
         if [ -z "$update" ]; then