Merge ubuntu-cve-tracker:ros-esm into ubuntu-cve-tracker:master

[Florencia Cabral]

Add README.ros-esm, edit EOL tag for ROS ESM distros

* Add README.ros-esm with guidance on handling ROS ESM CVEs.
* Edit to scripts/cve_lib.py: change ROS Kinetic (Xenial) to non-EOL.

[Eduardo Barretto (ebarretto)]

A few comments, let me know what you think

[Eduardo Barretto (ebarretto)]

LGTM

review: Approve

[Eduardo Barretto (ebarretto)]

is this going to be merged?

diff --git a/README.ros-esm b/README.ros-esm
new file mode 100644
index 0000000..53d43f5
--- /dev/null
+++ b/README.ros-esm
@@ -0,0 +1,12 @@
+ROS ESM
+-------------------------
+The Robotics team maintains the ROS (Robot Operating System) ESM as a separate service from regular ESM. For more details on ROS ESM, you can visit its wiki page: https://wiki.canonical.com/UbuntuEngineering/Security/ROS-ESM/ 
+
+Currently, ROS ESM supports two distros: ROS Kinetic, for Ubuntu Xenial, and ROS Melodic, for Ubuntu Bionic.
+
+To determine the package you’re working on is a ROS ESM package, please refer to the list of supported packages for ROS Kinetic ('ros-esm-xenial-kinetic-supported.txt') and ROS Melodic ('ros-esm-bionic-melodic-supported.txt').
+
+How to proceed?
+
+If a CVE affects a ROS ESM package, just notify the Robotics team via Mattermost (https://chat.canonical.com/canonical/channels/robotics), and leave its status as 'needs-triage'. 
+
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index fe8e4f5..5433765 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -182,7 +182,7 @@ subprojects = {
         "description": "Available with UA ... https://ubuntu.com/advantage",
     },
     "ros-esm/kinetic": {
-        "eol": True,
+        "eol": False,
         "packages": ["ros-esm-xenial-kinetic-supported.txt"],
         "name": "Ubuntu 16.04 ROS ESM",
         "codename": "Xenial Xerus",