Re: [OE-core] [PATCH] cve-check: Add allowlist that is same function of whitelist.

["Richard Purdie" <richard.purdie@linuxfoundation.org>]

On Wed, 2021-06-23 at 17:56 +0900, ito-yuichi@fujitsu.com wrote:
> The Linux team plan to removed references to racially-charged jargon from
> their code for more neutral and inclusive language.
> So replace use of "whitelist" with "allowlist" in cve-check.
> 
> First, we add CVE_CHECK_ALLOWLIST and it is considered patched as well as
> CVE_CHECK_WHITELIST.
> We plan to replace about other word later and eventualy, replace all
> "whitelist" to "allowlist".
> 
> Signed-off-by: Yuichi Ito <ito-yuichi@fujitsu.com>

The TSC did discuss this and proposed a plan on how we should go about 
addressing these issues:

https://lists.openembedded.org/g/openembedded-architecture/topic/inclusive_language_summary/75821819

I appreciate this patch has good intent but I would really like to
see a wider plan on how we address this rather than changing single 
variables piecemeal. 

For example we may want to standardise on the term "IGNORE" rather than
"ALLOW" or even "FILTER" or "VERIFIED" or something more specific to the meaning
of CVEs and CVE checking.

There is an opportunity to try and make the metadata and variable names
more consistent and understandable but if we just change single things at
a time this opportunity would be missed.

Cheers,

Richard