Repository navigation
Add optional CVE metadata for Security entries - #95
StanFromIreland wants to merge 2 commits into
Conversation
| body = f'bpo-{issue_number}: {body}' | ||
| prefix = f'bpo-{issue_number}' | ||
| if cve := metadata.get('cve'): | ||
| prefix = f'{prefix}, {cve}' if prefix else cve |
There was a problem hiding this comment.
Let's do something like this to use the Sphinx :cve: role:
https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-cve
| prefix = f'{prefix}, {cve}' if prefix else cve | |
| cve_role = f':cve:`{cve.removeprefix("CVE-")}`' | |
| prefix = f'{prefix}, {cve_role}' if prefix else cve_role | |
There was a problem hiding this comment.
Shall we put the CVE before the gh-number?
That's what we did at https://blog.python.org/2026/10/python-31022-31117/ and I think the CVE is more interesting for readers?
There was a problem hiding this comment.
We can't add the role, it would break 3.11, as it uses an older version of Sphinx that does not support the role. I have a PR (python/cpython#159415) in CPython to add as part of our build process, like we do for the GitHub reference.
| if 'cve' in metadata and metadata.get('section') != cve_section: | ||
| throw(f"'cve:' may only be used in the {cve_section!r} section!") |
There was a problem hiding this comment.
We have sometimes included CVEs in non-security sections:
- Windows: gh-98689: Update Windows builds to zlib v1.2.13 cpython#98968
- Library: gh-149148: Upgrade bundled pip to 26.1 cpython#149150
Should we not allow those? In those cases, should they have been under Security?
There was a problem hiding this comment.
IMO, from a distributor's perspective (though I've never worn that hat ;-)), it would have been clearer to put these in the Security section, since that's what prompted the update.
I'm also not entirely sure these should be marked with .. cve:, as my intention was to reserve that for CVEs we issue ourselves.
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
This branch has not been deployed
2 participants
This recently came up on Discourse, CVEs are useful information for users, however they aren't always listed in the entries. The patch adds a special field for them, and support to render them beside the issue number in the changelog.