Subject: Question about secfixes in APKBUILD

From: Guilherme Macedo <[email-masked]>
Date: Sat, 16 Nov 2024 07:35:28 -0300

Hey list.

I've a question about the secfixes comments in the APKBUILD spec. Do I
understand right that all false-positives CVEs (the CVEs not
affecting a package) in Alpine are listed with the version as "0"?

Examples:
- https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/openssh/APKBUILD#L88-89
- https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/openssl/APKBUILD#L113-118

I tried to look for this in the docs, but couldn't find a note about
this. Apologies in case I missed it.

Thanks in advance,
Guilherme

---

From: "fossdd" <[email-masked]>
Date: Sat, 16 Nov 2024 12:46:55 +0100

> - https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/openssl/APKBUILD#L113-118

Yes, it has become somewhat a norm to mark them as 0. However the right place for
such false-positives is at https://gitlab.alpinelinux.org/alpine/security/security-rejections

---

From: Guilherme Macedo <[email-masked]>
Date: Sat, 16 Nov 2024 09:01:37 -0300

On Sat, 16 Nov 2024 12:46:55 +0100
"fossdd" <[email-masked]> wrote:

> > I've a question about the secfixes comments in the APKBUILD spec.
> > Do I understand right that all false-positives CVEs (the CVEs not
> Yes, it has become somewhat a norm to mark them as 0. However the
> right place for such false-positives is
> at https://gitlab.alpinelinux.org/alpine/security/security-rejections
> 

Thanks for the explanation and for pointing to the rejections repo. I
wasn't aware of it. It seems, unfortunately, that it's not in sync with
the ones marked in the individual APKBUILDs.

Do you know if there is any effort or plans to build automation around
this to keep them in sync?

---

From: "fossdd" <[email-masked]>
Date: Sun, 17 Nov 2024 00:12:18 +0100

> this to keep them in sync?

Yeah, i guess some developers prefer the 0-method more than the other,
since it's easier to add. I don't think that someone plans to merge
them anytime soon.