On Tue, Aug 25, 2026 at 16:05:39 +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Introduce a job which will run with the scheduled libvirt pipeline runs which will check if all CVEs mentioned in the git commit messages, NEWS entries and for all libvirt security notices published at https://security.libvirt.org have corresponding git tags.
Since git commit messages do sometimes mention CVE not related to libvirt, the '.cve_exceptions' file lists allows to add overrides.
Since the upstream repository has signed tags, the tagging is done by Jirka, so it doesn't make sense to run this check inside the checkout or as a regular CI pipeline run, so it's implemented directly in the CI job rather than as a standalone tool.
The job also creates an artifact containing all tagged CVEs in the repository. This can later be used e.g. to see which CVEs are missing a libvirt security notice.
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- .cve_exceptions | 46 +++++++++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 .cve_exceptions
This is how the pipeline result looks when it picks up something that needs to be tagged: https://gitlab.com/pipo.sk/testlibvirt/-/jobs/16094064680
In order for this to pass the following CVEs need to be tagged (the order of the commit IDs is as 'git log' shows):
And after this list of commits is tagged successful result: https://gitlab.com/pipo.sk/testlibvirt/-/jobs/16094536454