Move CVE information into advisories directory

One of the requirements to becoming a CVE Numbering Authority (CNA) is
to publish advisories.  Do this by maintaining a file for each CVE fixed
in the advisories directory in the source tree.  Links to the advisories
can then be shared as:

https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-YYYY-NNNN

The file format at the moment is rudimentary and derives from the git
commit format, i.e. a subject line and a potentially multi-paragraph
description and then tags to describe some meta information.  This is a
loose format at the moment and could change as we evolve this.

Also add a script process-fixed-cves.sh that processes these advisories
and generates a list to add to NEWS at release time.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

1 files changed, 41 insertions, 0 deletions

diff --git a/scripts/process-fixed-cves.sh b/scripts/process-fixed-cves.sh
new file mode 100755
index 0000000000..7a870f57ae
--- /dev/null
+++ b/scripts/process-fixed-cves.sh
@@ -0,0 +1,41 @@
+#!/bin/bash -e
+# Copyright The GNU Toolchain Authors.
+# This file is part of the GNU C Library.
+#
+# The GNU C Library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# The GNU C Library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNU C Library; if not, see
+# <https://www.gnu.org/licenses/>.
+
+if ! [ -d advisories ]; then
+  echo "error: Run me from the toplevel directory of the glibc repository."
+  exit 1
+fi
+
+release=$(echo RELEASE | gcc -E -include version.h -o - - | grep -v "^#")
+minor=$(echo __GLIBC_MINOR__ | gcc -E -include include/features.h -o - - |
+	grep -v "^#")
+
+if [ $release = "\"development\"" ]; then
+  cur_rel=2.$((minor + 1))
+else
+  cur_rel=2.$minor
+fi
+
+for f in $(grep -l "^Fix-Commit: .* ($cur_rel)$" advisories/*); do
+  echo -e "  $(basename $f):"
+  cve_id=$(sed -n 's/CVE-Id: \(.*\)/\1/p' $f)
+  echo "$(head -1 $f) ($cve_id)" | fold -w 68 -s | while read line; do
+    echo "    $line"
+  done
+  echo
+done