The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.
FLOP:CVE Monitoring
Funtoo Linux Optimization Proposal: CVE Monitoring
Summary
Ultimately, not all ebuilds are created equal. Hence they are updated at different rates according to their popularity in the tree of available packages and this is generally fine: packages with a lot of use get updated frequently, and vulnerabilities are generally dealt with. Unpopular ebuilds can languish, and no one really cares. However, unpopular ebuilds with a significant vulnerability should be updated, popular or not, as they represent a potential vector for attack, if they can be installed.
Identifying ebuilds with an associated CVE will bring them to 'head of the queue' for pull requests and updates, which should often be trivial, as the vulnerability is dealt with upstream and released as a new hotfix version. Or, we can fork and provide our own mitigation, merging with upstream again when a new release comes out (if at all).
The cver tool is built around redis and mongodb collections that are regularly updated with newly filed CVEs. The tool queries the collections to produce a set of text data appropriate to fill fields on a newly created security vulnerability issue on the Funtoo bug tracker. The data can be output in various formats (current just formatted text on stdout), and eventually input directly to the bug tracker via its REST api.
Architecture
The architecture is simple:
┌─────────┐
│redis │ ┌────┐
│┌───────┐│ │jira│──────────┐
││mongoDB││ └──┬─┘ │
│└───────┘│ │ │
└────┬────┘ │ │
│ │ *********
│ ┌───┐ │ *** ***
├─────┤dev│──────────* discussion *
│ └───┘ │ *** ***
│ │ *********
│ │
│ ┌───┐ │
├─────┤bot│────┘
│ └───┘
│
│
│ ┌───┐
└─────│usr│
└───┘