[isar-cip-core 0/3] Generate CVE-reports during a tag release

From: Sai.Sathujoda@toshiba-tsip.com
To: cip-dev@lists.cip-project.org, jan.kiszka@siemens.com
Cc: Sai Sathujoda <Sai.Sathujoda@toshiba-tsip.com>,
	dinesh.kumar@toshiba-tsip.com, kazuhiro3.hayashi@toshiba.co.jp
Subject: [isar-cip-core 0/3] Generate CVE-reports during a tag release
Date: Thu, 21 Dec 2023 17:34:20 +0530	[thread overview]
Message-ID: <20231221120423.2388639-1-Sai.Sathujoda@toshiba-tsip.com> (raw)

From: Sai Sathujoda <Sai.Sathujoda@toshiba-tsip.com>

This series of patches enables generation of CVE-reports from a latest copy of
dpkg-status files stored in CIP project's s3 bucket whenever a tag is released.
This is to follow IEC 62443-4-1 SM-11 requirement where security related issues
are addressed along with their severity prior a release.

debian-cve-checker repository [1] is used to generate the CVE-reports from the
dpkg-status of repsective targets.

Sai Sathujoda (3):
  scripts/run-cve-checks.sh: Add script to generate CVE report
  scripts/deploy-cip-core.sh: Upload dpkg-status files to aws s3 bucket
  .gitlab-ci.yml: Add cve-checks job which runs when a tag is pushed

 .gitlab-ci.yml             |  7 +++++++
 scripts/deploy-cip-core.sh | 12 ++++++++++++
 scripts/run-cve-checks.sh  | 40 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+)
 create mode 100755 scripts/run-cve-checks.sh

-- 
2.30.2