Update advisory format and introduce some automation

Simplify the advisory format by dropping the -Backport tags and instead
stick to using just the -Commit tags.  To identify backports, put a
substring of git-describe into the release version in the brackets next
to the commit ref.  This way, it not only identifies that the fix (or
regression) is on the release/2.YY/master branch, it also disambiguates
regressions/fixes in the branch from those in the tarball.

Add a README to make it easier for consumers to understand the format.
Additionally, the Release wiki needs to be updated to inform the release
manager to:

1. Generate a NEWS snipped from the advisories directory

AND

2. on release/2.YY/master, replace the advisories directory with a text
   file pointing to the advisories directory in master so that we don't
   have to update multiple locations.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: Andreas K. Hüttel <dilfridge@gentoo.org>

6 files changed, 97 insertions, 26 deletions

diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001
index 12b4f8edb8..3d19c91b6a 100644
--- a/advisories/GLIBC-SA-2023-0001
+++ b/advisories/GLIBC-SA-2023-0001
@@ -11,4 +11,4 @@ CVE-Id: CVE-2023-25139
 Public-Date: 2023-02-02
 Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37)
 Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38)
-Fix-Backport: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37)
+Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4)
diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002
index 32e45f524f..5122669a64 100644
--- a/advisories/GLIBC-SA-2023-0002
+++ b/advisories/GLIBC-SA-2023-0002
@@ -10,6 +10,6 @@ CVE-Id: CVE-2023-4527
 Public-Date: 2023-09-12
 Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36)
 Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39)
-Fix-Backport: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36)
-Fix-Backport: b7529346025a130fee483d42178b5c118da971bb (2.37)
-Fix-Backport: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38)
+Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113)
+Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38)
+Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19)
diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003
index 0950dc0792..d3aef80348 100644
--- a/advisories/GLIBC-SA-2023-0003
+++ b/advisories/GLIBC-SA-2023-0003
@@ -8,8 +8,8 @@ arbitrary memory.
 CVE-Id: CVE-2023-4806
 Public-Date: 2023-09-12
 Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39)
-Fix-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34)
-Fix-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35)
-Fix-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36)
-Fix-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37)
-Fix-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38)
+Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420)
+Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270)
+Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115)
+Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39)
+Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20)
diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004
index cba13db38f..5286a7aa54 100644
--- a/advisories/GLIBC-SA-2023-0004
+++ b/advisories/GLIBC-SA-2023-0004
@@ -9,8 +9,8 @@ CVE-Id: CVE-2023-4911
 Public-Date: 2023-10-03
 Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34)
 Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39)
-Fix-Backport: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34)
-Fix-Backport: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35)
-Fix-Backport: 22955ad85186ee05834e47e665056148ca07699c (2.36)
-Fix-Backport: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37)
-Fix-Backport: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38)
+Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423)
+Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274)
+Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118)
+Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45)
+Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27)
diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005
index a518af803a..cc4eb90b82 100644
--- a/advisories/GLIBC-SA-2023-0005
+++ b/advisories/GLIBC-SA-2023-0005
@@ -6,15 +6,13 @@ flags set.
 
 CVE-Id: CVE-2023-5156
 Public-Date: 2023-09-25
-Vulnerable-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (pre-2.39)
-Fix-Commit: ec6b95c3303c700eb89eebeda2d7264cc184a796 (2.39)
-Vulnerable-Backport: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34)
-Vulnerable-Backport: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35)
-Vulnerable-Backport: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36)
-Vulnerable-Backport: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37)
-Vulnerable-Backport: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38)
-Fix-Backport: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34)
-Fix-Backport: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35)
-Fix-Backport: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36)
-Fix-Backport: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37)
-Fix-Backport: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38)
+Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420)
+Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270)
+Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115)
+Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39)
+Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20)
+Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421)
+Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272)
+Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116)
+Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42)
+Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24)
diff --git a/advisories/README b/advisories/README
new file mode 100644
index 0000000000..94e68b1350
--- /dev/null
+++ b/advisories/README
@@ -0,0 +1,73 @@
+GNU C Library Security Advisory Format
+======================================
+
+Security advisories in this directory follow a simple git commit log
+format, with a heading and free-format description augmented with tags
+to allow parsing key information.  References to code changes are
+specific to the glibc repository and follow a specific format:
+
+  Tag-name: <commit-ref> (release-version)
+
+The <commit-ref> indicates a specific commit in the repository.  The
+release-version indicates the publicly consumable release in which this
+commit is known to exist.  The release-version is derived from the
+git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and
+is of the form 2.34-NNN.  If the -NNN suffix is absent, it means that
+the change is in that release tarball, otherwise the change is on the
+release/2.YY/master branch and not in any released tarball.
+
+The following tags are currently being used:
+
+CVE-Id:
+This is the CVE-Id assigned under the CVE Program
+(https://www.cve.org/).
+
+Public-Date:
+The date this issue became publicly known.
+
+Vulnerable-Commit:
+The commit that introduced this vulnerability.  There could be multiple
+entries, one for each release branch in the glibc repository; the
+release-version portion of this tag should tell you which branch this is
+on.
+
+Fix-Commit:
+The commit that fixed this vulnerability.  There could be multiple
+entries for each release branch in the glibc repository, indicating that
+all of those commits contributed to fixing that issue in each of those
+branches.
+
+Adding an Advisory
+------------------
+
+An advisory for a CVE needs to be added on the master branch in two steps:
+
+1. Add the text of the advisory without any Fix-Commit tags along with
+   the fix for the CVE.  Add the Vulnerable-Commit tag, if applicable.
+   The advisories directory does not exist in release branches, so keep
+   the advisory text commit distinct from the code changes, to ease
+   backports.  Ask for the GLIBC-SA advisory number from the security
+   team.
+
+2. Finish all backports on release branches and then back on the msater
+   branch, add all commit refs to the advisory using the Fix-Commit
+   tags.  Don't bother adding the release-version subscript since the
+   next step will overwrite it.
+
+3. Run the process-advisories.sh script in the scripts directory on the
+   advisory:
+
+     scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN
+
+   (replace YYYY-NNNN with the actual advisory number).
+
+4. Verify the updated advisory and push the result.
+
+Getting a NEWS snippet from advisories
+--------------------------------------
+
+Run:
+
+  scripts/process-advisories.sh news
+
+and copy the content into the NEWS file.