Repository navigation
Add optional CVE metadata for Security entries - #95
StanFromIreland wants to merge 1 commit into
Conversation
| body = f'bpo-{issue_number}: {body}' | ||
| prefix = f'bpo-{issue_number}' | ||
| if cve := metadata.get('cve'): | ||
| prefix = f'{prefix}, {cve}' if prefix else cve |
There was a problem hiding this comment.
Let's do something like this to use the Sphinx :cve: role:
https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-cve
| prefix = f'{prefix}, {cve}' if prefix else cve | |
| cve_role = f':cve:`{cve.removeprefix("CVE-")}`' | |
| prefix = f'{prefix}, {cve_role}' if prefix else cve_role | |
There was a problem hiding this comment.
Shall we put the CVE before the gh-number?
That's what we did at https://blog.python.org/2026/10/python-31022-31117/ and I think the CVE is more interesting for readers?
There was a problem hiding this comment.
We can't add the role, it would break 3.11. I have a PR in CPython to add it there, like we do for GitHub issues.
| if int(issue_number): | ||
| body = f'bpo-{issue_number}: {body}' | ||
| prefix = f'bpo-{issue_number}' | ||
| if cve := metadata.get('cve'): |
There was a problem hiding this comment.
Bit of whitespace
| if cve := metadata.get('cve'): | |
| if cve := metadata.get('cve'): |
|
|
||
| # Assert | ||
| text = Path('NEWS').read_text(encoding='utf-8') | ||
| assert '- gh-135661, CVE-2025-6069: Fix a security issue.\n' in text |
There was a problem hiding this comment.
| assert '- gh-135661, CVE-2025-6069: Fix a security issue.\n' in text | |
| assert '- gh-135661, :cve:`2025-6069`: Fix a security issue.\n' in text |
| if 'cve' in metadata and metadata.get('section') != cve_section: | ||
| throw(f"'cve:' may only be used in the {cve_section!r} section!") |
There was a problem hiding this comment.
We have sometimes included CVEs in non-security sections:
- Windows: gh-98689: Update Windows builds to zlib v1.2.13 cpython#98968
- Library: gh-149148: Upgrade bundled pip to 26.1 cpython#149150
Should we not allow those? In those cases, should they have been under Security?
|
|
||
| def _check_commented_cve(tmp_path: str) -> str: | ||
| """Return an error message if a CVE was filled in but left commented out.""" | ||
| with open(tmp_path, encoding='utf-8') as file: |
There was a problem hiding this comment.
This opens the file a second time. Not a big deal as it's a small file, but perhaps we could read just once and pass the contents?
Actually, I think it would be cleaner to move this parsing into the main parser at Blurbs.parse() and drop this function and second open.
This branch has not been deployed
2 participants
This recently came up on Discourse, CVEs are useful information for users, however they aren't always listed in the entries. The patch adds a special field for them, and support to render them beside the issue number in the changelog.