#1088779 Add support for CVE meta tag

Package:
git-buildpackage
Source:
git-buildpackage
Submitter:
Michael Biebl
Date:
2026-04-20 18:09:14 UTC
Severity:
normal
#1088779#5
Date:
2024-11-30 21:33:48 UTC
From:
To:
Hi,

it would be nice if gbp-dch would learn to handle CVEs.

My suggestion would be to add a `CVE: CVE-XXXX-XXXXX` meta tag.

I'm open how this is represented in the resulting debian/changelog.
#1088779#10
Date:
2026-04-19 10:16:30 UTC
From:
To:
Hi,

If we don't want to rework the whole thing (allowing to introduce
arbitrary tags) extracting the tag itself would be rather simple. I
wonder about the representation in the changelog though. Do you have
some example packages that don't use the:

* CVE-XXXX-XXXX: msg1
* CVE-YYYY-YYYY: msg2

pattern (because that doesn't need any special handling).

Cheers,
 -- Guido
#1088779#15
Date:
2026-04-19 20:15:40 UTC
From:
To:
Hi Guido,

Am 19.04.26 um 12:16 schrieb Guido Günther:
I typically use "* msg (CVE-XXXX-XXXX, Closes: #12345)" and if there is
no Closes then simply "* msg (CVE-XXXX-XXXX)", i.e. the Closes and CVE
information is in parenthesis.


But as said, I'm fine whatever scheme you choose.

"* CVE-XXXX-XXXX: msg (Closes: #12345)"

looks fine to me as well.

Should we ask the security what style they prefer?

Michael
#1088779#20
Date:
2026-04-20 18:08:48 UTC
From:
To:
Hi,

I think that's what I've seen the most but in this case I assume people
would put the `CVE-` into the commit subject anyway? It doesn't work
well when a commit fixes multiple CVEs. This would work better with
the format you use.

Feel free to. I'm fine with whatever comes up as a result.

Cheers,
 -- Guido