Re: [gentoo-dev] [PATCH dtd] glsa.dtd: Allow slot="" attribute for vulnerable&unaffected

[Mart Raudsepp <leio@gentoo.org>]

Ühel kenal päeval, T, 11.04.2017 kell 22:10, kirjutas Michał Górny:
> Officially list the slot="" attribute that is used in GLSAs for quite
> some time in the DTD. It is supported by Portage and gentoolkit for
> a long time, and was used in GLSAs interchangeably with implicit
> appended ':slot' to the version. However, the latter was ugly and
> worked
> only by accident, so we are moving towards the former.

':slot' version was only used for less than a day until it was reverted
back to slot attribute. Slot attributes are used since January or so in
existing GLSAs where needed to avoid old slot version bumps starting to
give false positives, e.g libpng and such.

For further context for other readers, slot="" attribute support has
been in glsa-check for at least Q4 2008, potentially Q3 2007. The code
was synced to portage near there as well I believe (for @security and
such usage).

> ---
>  glsa.dtd | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/glsa.dtd b/glsa.dtd
> index 52be18e..22237b0 100644
> --- a/glsa.dtd
> +++ b/glsa.dtd
> @@ -124,7 +124,8 @@
>      Description:  Version of the vulnerable package. Can be a range
> too

Maybe some slot attribute documentation could be added as well, similar
to how the original patch attached to https://bugs.gentoo.org/106677
did? Though not the "*" stuff, that feels wrong and should be just
omitted attribute for that.


Mart