MIME-Version: 1.0
References: 
 <CAD59NR0X7w6N-8o+rGUPcyH+gbBLc6CGPRVRZy_UsAB73s3tTA@mail.gmail.com>
 <20190723091240.733103de@ncopa-desktop.copa.dup.pw>
 <CAD59NR0z51BV+n3T0NJOdURG6AVu=x0e89eXv8ZZU+-PkcGBMA@mail.gmail.com>
 <CA+cSEmNmtj3m458Gu4ZYh4VwtMFw2xEGq38bs_+vcLosNr2ZRg@mail.gmail.com>
 <CAD59NR2GuL0hAEp70DCf2WvL8zKQKHTGfxoeng4wLE3SB1xNnQ@mail.gmail.com>
 <20190723111532.5a18f982@ncopa-desktop.copa.dup.pw>
 <CAD59NR1rMTYu06Gd4fjxhpPJSYyCwFZv9WDm35MbQxHJN2NqzQ@mail.gmail.com>
In-Reply-To: 
 <CAD59NR1rMTYu06Gd4fjxhpPJSYyCwFZv9WDm35MbQxHJN2NqzQ@mail.gmail.com>
From: Teppei Fukuda <knqyf263@gmail.com>
Date: Sun, 11 Aug 2019 14:29:50 -1000
Message-ID: 
 <CAD59NR0KfYZv1=7c7py03nOkqnzYsoT0LgfFZStCHw68+WLjwg@mail.gmail.com>
Subject: Re: Security Issues in Redmine
To: Natanael Copa <ncopa@alpinelinux.org>
Cc: Carlo Landmeter <clandmeter@alpinelinux.org>,
 ~alpine/devel@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Copa,

My apologies for keeping asking you questions, but I have one more question=
.

When I've been following the recent security related commits of
alpine/aports, I've noticed that you always write secfixes comment
even if they were not backported fixes. Was this defined as a rule?

As I mentioned before, I hope that security advisories of Alpine will
be provided. So I would like to help if I can do anything.

I know you are so busy. It would be appreciated if I discuss this with
you when you have time.

Best regards,
Teppei

2019=E5=B9=B47=E6=9C=8823=E6=97=A5(=E7=81=AB) 16:56 Teppei Fukuda <knqyf263=
@gmail.com>:
>
> Hi Copa,
>
> I appreciate your polite explanation. I understand.
>
> Currently, my program collects the following data:
> 1. the secfixes comments in APKBUILD
> 2. alpine-secdb (maybe the same as above)
> 3. the security tickets of Redmine (will be replaced with the issues of G=
itLab)
> 4. git diff APKBUILD (only commits related with the above issues)
>
> I think we can generate the security advisories by checking all git
> log like No. 4. For example, the following commit fixes
> CVE-2019-13636.
> https://github.com/alpinelinux/aports/pull/9642/files
>
> Watching this diff of main/patch/APKBUILD, we can detect the version
> update from 2.7.6-r4 to 2.7.6-r5. This is my source code doing it.
> https://github.com/knqyf263/vuln-list-update/blob/d8aefa60155637561a8a2d3=
feb486bbb675c996c/alpine/alpine.go#L404-L450
>
> I know this way is not perfect. There may be false positive/negative.
> However, this process can be automated and the maintenance cost is
> low. It may be a good way as a first step of the security advisory. It
> is better if the format of the commit message is fixed. e.g.
> [os_version] pkgname: fix CVE-ID.
>
> I want the security database of Alpine strongly and can help you in
> the task of investigating it and writing an automation program. But,
> It is difficult to do manual operation (e.g. I continue to fill the
> security information manually).
>
> Best,
> Teppei
>
> 2019=E5=B9=B47=E6=9C=8823=E6=97=A5(=E7=81=AB) 18:18 Natanael Copa <ncopa@=
alpinelinux.org>:
> >
> > On Tue, 23 Jul 2019 17:54:40 +0900
> > Teppei Fukuda <knqyf263@gmail.com> wrote:
> >
> > > Hi Carlo,
> > >
> > > Yes, it is. However, alpine-secdb is database of backported fixes as
> > > README says.
> > > >It is not a complete database of all security issues in Alpine.
> > >
> > > I need a complete database of all security issues.
> >
> > We currently don't have that. I do think we have much or maybe even
> > most of the needed data, but its spread.
> >
> > We need someone who can figure out the pieces that is missing and find
> > a way to collect and store it in a way that makes it as simple as
> > possible to fix and roll out fixes.
> >
> > We could for example use the secfixes comments in APKBUILD and data
> > from gitlab issues and generate a database from that, and have someone
> > fill in the missing data, or we could turn it around, have someone
> > collect all the data in a database and generate issues from that and
> > maybe automatically add secfixes comments from it.
> >
> > But we need someone who can investigate and come up with a good plan.
> >
> > -nc