Migrate Gentoo importer to advisory V2 #2090
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ziadhany
changed the title
ziadhany
force-pushed
the
gentoo-migration
branch
from
77f89b8 to
7ef7684
Compare
Collaborator
Author
|
gentoo importer V2 logs: gentoo importer V1 logs: |
ziadhany
commented
Jan 1, 2026
Collaborator
Author
ziadhany
force-pushed
the
gentoo-migration
branch
2 times, most recently
from
76f65a8 to
0bed9dd
Compare
ziadhany
force-pushed
the
gentoo-migration
branch
from
4c5830d to
ca3fc16
Compare
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Update the Gentoo get_safe_and_affected_versions function in advisory v2 Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
ziadhany
force-pushed
the
gentoo-migration
branch
from
76c1f80 to
a5e7bd4
Compare
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
keshav-space
requested changes
Feb 5, 2026
Member
keshav-space
left a comment
keshav-space
left a comment
There was a problem hiding this comment.
@ziadhany Thanks, see some feedback below.
|
|
||
| affected_package = AffectedPackageV2( | ||
| package=purl, | ||
| affected_version_range=EbuildVersionRange(constraints=[constraint]), |
Member
There was a problem hiding this comment.
It does not make sense to report unaffected range in affected_version_range.
Comment on lines
144
to
145
| if invert: | ||
| constraint = constraint.invert() |
Member
There was a problem hiding this comment.
@ziadhany why do we invert fixed range, we should report fixed range as is.
Collaborator
Author
There was a problem hiding this comment.
@keshav-space we have two type of package version
- unaffected
- vulnerable
GLSA-201405-01 , CVE-2014-0004
<affected>
<package name="sys-fs/udisks" auto="yes" arch="*">
<unaffected range="rge">1.0.5</unaffected>
<unaffected range="ge">2.1.3</unaffected>
<vulnerable range="lt">2.1.3</vulnerable>
</package>
</affected>
we invert the unaffected (safe_version) to get the affected version if it isn’t specified.
see line: 159, 162
the main question is that does the unaffected mean fixed range, if yes I should update this
Member
There was a problem hiding this comment.
the main question is that does the unaffected mean fixed range, if yes I should update this
@ziadhany Yes, unaffected is fixed range see resolution section here https://security.gentoo.org/glsa/201405-01 so if we get unaffected range it should be treated as fixed range.
Also rge means revision greater than equals and rgt means revision greater than lets mention this in comments.
<unaffected range="ge">2.1.3</unaffected> is pretty straight forward it translates to fixed range vers:ebuild/>=2.1.3. But revision range are bit tricky here <unaffected range="rge">1.0.5</unaffected> translates to vers:ebuild/>=1.0.5|<1.1 see the interpretation here https://security.gentoo.org/glsa/201405-01
similarly for this advisory https://security.gentoo.org/glsa/202004-13 we have these unaffected range
<unaffected range="rge">2.23.3</unaffected>
<unaffected range="rge">2.24.3</unaffected>
<unaffected range="rge">2.25.4</unaffected>
<unaffected range="rge">2.26.2</unaffected>and these would be interpreted as fixed range
vers:ebuild/>=2.23.3|<2.24
vers:ebuild/>=2.24.3|<2.25
vers:ebuild/>=2.25.4|<2.26
vers:ebuild/>=2.26.2|<2.27
Comment on lines
37
to
50
| { | ||
| "package": { | ||
| "type": "ebuild", | ||
| "namespace": "dev-vcs", | ||
| "name": "subversion", | ||
| "version": "", | ||
| "qualifiers": "", | ||
| "subpath": "" | ||
| }, | ||
| "affected_version_range": "vers:ebuild/<=1.8.18", | ||
| "fixed_version_range": null, | ||
| "introduced_by_commit_patches": [], | ||
| "fixed_by_commit_patches": [] | ||
| } |
Member
There was a problem hiding this comment.
Not right, for the unaffected range <unaffected range="ge">1.9.7</unaffected> and <unaffected range="rgt">1.8.18</unaffected> we should report vers:ebuild/>1.8.18 and vers:ebuild/1.9.7 as fixed version range and do not invert these and report it as affected vers.
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
… and fixed_version_range for non-revision versions Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue: