[Git][security-tracker-team/security-tracker][master] 2 commits: sign-advisory.sh: warn when about to sign an unmodified template

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
196c4494 by Aron Xu at 2026-10-27T13:38:26+08:00
sign-advisory.sh: warn when about to sign an unmodified template

Before signing, scan the advisory body for leftovers from the
gen-D{L,S}A template and ask for confirmation if any are found:

- unreplaced $VARIABLES (e.g. $bookworm_VERSION when no fixed
  version was provided)
- the default $TEXT: "... text goes here" (0 or 1 CVE), "Brief
  introduction" followed by bare "Description" lines (multiple
  CVEs, as sent out by mistake in DSA-6584-1), or "The CVE ids will
  be listed here when --save'ing"

Aborting is the default, so an unedited template can no longer be
signed by mistake, while a false positive only costs one keystroke.
The check runs before the .signed output file is created, so bailing
out leaves no empty/truncated file behind.

- - - - -
5fb45617 by Salvatore Bonaccorso at 2026-10-27T16:30:21+01:00
Merge branch 'sign-advisory-template-check' into 'master'

sign-advisory.sh: warn when about to sign an unmodified template

See merge request security-tracker-team/security-tracker!333
- - - - -


1 changed file:

- bin/sign-advisory.sh


Changes:

=====================================
bin/sign-advisory.sh
=====================================
@@ -49,6 +49,19 @@ signed_dsa=${dsa}.signed
 # figure out the offset for actual DSA text, after headers
 n=$(awk '/^$/ {print NR+1 ; exit}' $dsa)
 
+# crude check for an unedited template: unreplaced $VARIABLES
+# (e.g. $bookworm_VERSION) or default $TEXT leftovers should never be
+# signed: "text goes here" (0 or 1 CVE), "Brief introduction" with
+# bare "Description" lines (multiple CVEs, cf. DSA-6584-1), or "The
+# CVE ids will be listed here when --save'ing"
+template_re='\$[A-Za-z_]+|text goes here|^Brief introduction[[:space:]]*$|^[[:space:]]+Description[[:space:]]*$|listed here when'
+if tail -n +"$n" "$dsa" | grep -qE "$template_re" ; then
+  echo "warning: $dsa looks like an unmodified advisory template:" >&2
+  tail -n +"$n" "$dsa" | grep -nE "$template_re" >&2
+  read -r -p "sign it anyway? [y/N] " reply
+  [[ $reply == [yY]* ]] || exit 1
+fi
+
 # create empty destination file with same permissions as the source
 :> $signed_dsa
 chmod --reference=$dsa $signed_dsa



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/094f31e6e675182ba34fee064d2b6563b67a2468...5fb456176fb5ffb615ceded30ac6a36aa6dd1f0a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/094f31e6e675182ba34fee064d2b6563b67a2468...5fb456176fb5ffb615ceded30ac6a36aa6dd1f0a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/155f8831/attachment-0001.htm>