Fwd: RE: Re: [oe] [PATCH][meta-oe] php: uprev it to 5.5.24

[Philip Balister]

This email reminded me of the talk about standardizing commit messages
for CVE's. We should document this somewhere so people know how to look
for CVE's.

Sona had some thoughts and I remembered this:

http://openembedded.org/wiki/Commit_Patch_Message_Guidelines

Does this page need updating? It certainly needs the CVE information.

Philip

-------- Forwarded Message --------
Subject: RE: Re: [oe] [PATCH][meta-oe] php: uprev it to 5.5.24
Date: Thu, 23 Apr 2015 18:51:53 +0000
From: Sona Sarmadi <sona.sarmadi at enea.com>
To: Philip Balister <philip at balister.org>

Hi Philip,

We have some guidelines for security patches in the Yocto project's wiki:

https://wiki.yoctoproject.org/wiki/Security => Patch name convention and
commit message

Do you think a similar guidelines would be good to have in the
openembedded's  wiki? Or a link to Yoctos's security wiki?

I can send email and remind people about these guidelines once in a while :)

Have a nice day !
/Sona

> -----Original Message-----
> From: Philip Balister [mailto:philip at balister.org]
> Sent: den 23 april 2015 19:14
> To: Sona Sarmadi
> Subject: Fwd: Re: [oe] [PATCH][meta-oe] php: uprev it to 5.5.24
> 
> This might be a good time to remind people how you want CVE's to appear in
> the commit log.
> 
> Philip
> 
> 
> -------- Forwarded Message --------
> Subject: Re: [oe] [PATCH][meta-oe] php: uprev it to 5.5.24
> Date: Thu, 23 Apr 2015 10:30:45 +0100
> From: Paul Eggleton <paul.eggleton at linux.intel.com>
> Reply-To: openembedded-devel at lists.openembedded.org
> Organization: Intel Corporation
> To: rongqing.li at windriver.com
> CC: openembedded-devel at lists.openembedded.org
> 
> Hi Roy,
> 
> On Thursday 23 April 2015 11:21:13 rongqing.li at windriver.com wrote:
> > From: Roy Li <rongqing.li at windriver.com>
> >
> > 5.5.24 has lots of CVE fixes
> 
> I know it's a bit of a pain, but could you please list all of the CVEs in the
> commit message? Hopefully it should just be a matter of copying them from
> the release notes for the releases since 5.5.21.
> 
> Also, I see you've changed LIC_FILES_CHKSUM, please add a note to the
> commit message explaining exactly what changed in the license text to cause
> this (even if it's just a copyright year change as it often is).
> 
> Cheers,
> Paul
> 
> --
> 
> Paul Eggleton
> Intel Open Source Technology Centre
> --
> _______________________________________________
> Openembedded-devel mailing list
> Openembedded-devel at lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-devel
> 
>