Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Sat, 16 Nov 2024 12:46:55 +0100
Message-Id: <D5NKU9M4QM1I.2IG6Z8D6S6EW4@pwned.life>
To: "Guilherme Macedo" <guilherme@gmacedo.com>,
 <~alpine/apk-tools@lists.alpinelinux.org>
Subject: Re: Question about secfixes in APKBUILD
From: "fossdd" <fossdd@pwned.life>
References: <20241116073528.75a751c2@gmacedo.com>
In-Reply-To: <20241116073528.75a751c2@gmacedo.com>

On Sat Nov 16, 2024 at 11:35 AM CET, Guilherme Macedo wrote:
> Hey list.
>
> I've a question about the secfixes comments in the APKBUILD spec. Do I
> understand right that all false-positives CVEs (the CVEs not
> affecting a package) in Alpine are listed with the version as "0"?
>
> Examples:
> - https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/openssh=
/APKBUILD#L88-89
> - https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/openssl=
/APKBUILD#L113-118

Yes, it has become somewhat a norm to mark them as 0. However the right pla=
ce for
such false-positives is at https://gitlab.alpinelinux.org/alpine/security/s=
ecurity-rejections

>
> I tried to look for this in the docs, but couldn't find a note about
> this. Apologies in case I missed it.
>
> Thanks in advance,
> Guilherme