On Fri, Nov 06, 2026 at 12:15:06PM +0300, Michael Tokarev wrote: > Hi! > > What's the way you use to find these patches, with security impact or not? > > I usually quickly screen all new commits in the master branch, and often > catch things which aren't marked for-stable, - not everything of interest > is marked as such. I also tend to remind the maintainers about these > markings. But my resources here are limited, I can't try to understand > every patch, even description of it. > > How do you perform a security review?
FWIW, with our new security triage process, we should be fairly reliably getting issues in gitlab tagged with CVE::Assigned, if they have been accepted as an in-scope security issue and had a CVE assigned. Those issues should include a link to the mailing list with posted patches, and also get auto-linked to a merged commit by gitlab. So if you want to sanity check stable branch content for missing security fixes, I'd sugest following the CVE::Assigned labels. With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
