[Midnightbsd-cvs] [MidnightBSD/mports] 2882c5: security/vuxml: add MidnightBSD CVE candidate tool...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 2882c57a8fd7b1ff9b5db40941743ab1c843e333
      https://github.com/MidnightBSD/mports/commit/2882c57a8fd7b1ff9b5db40941743ab1c843e333
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-06 (Thu, 06 Aug 2026)

  Changed paths:
    M ai/claude-code/Makefile
    M ai/claude-code/distinfo
    M security/vuxml/Makefile
    A security/vuxml/files/check-shards.py
    A security/vuxml/files/vuxml-candidates.py
    M security/vuxml/vuln-flat.xml
    M security/vuxml/vuln.xml

  Log Message:
  -----------
  security/vuxml: add MidnightBSD CVE candidate tooling (#688)

## What changed

- add a `candidates` target that queries sec.midnightbsd.org using each
port's CPE metadata
- record MidnightBSD package version, `PORTREVISION`, `PORTEPOCH`, and
branch information in the candidate report
- omit CVEs already present in the local VuXML shards
- validate that every yearly shard is declared and referenced by
`vuln.xml`
- connect the existing 2026 shard and regenerate `vuln-flat.xml`

## Why

MidnightBSD currently relies on syncing FreeBSD VuXML data. FreeBSD
package versions can differ from MidnightBSD because revision and epoch
values do not necessarily align. This provides the first stage of a
MidnightBSD-native workflow: identify CVE candidates from the advisory
service while retaining the exact local package metadata needed to
construct correct VuXML ranges.

This PR expects the new `/api/cpe/ranges` endpoint from the companion
security-advisory PR.

## Validation

- `bmake makesum`
- `bmake patch`
- `bmake`
- `bmake fake`
- `bmake package`
- `bmake test`
- mock API integration test using `dns/bind918`
- `git diff --check`

The generated candidates are intentionally reviewable JSON; automatic
VuXML range insertion is left for a later phase after the revision/epoch
translation policy is finalized.

## Summary by Sourcery

Introduce MidnightBSD security advisory candidate tooling and keep VuXML
shards consistent with yearly XML files.

Enhancements:
- Add a Makefile candidates target and Python script to query
MidnightBSD security API using ports CPE metadata and emit JSON CVE
candidates with local package details.
- Record and validate yearly VuXML shard entity declarations and
references via a new shard consistency checker script.
- Connect the 2026 VuXML shard, update copyright years, and regenerate
the flattened VuXML document.

Tests:
- Extend validate target to run shard consistency checks alongside
existing VuXML validation.

---------

Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications