scripts/cve_reject

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Copyright (c) 2024 - Greg Kroah-Hartman <gregkh@linuxfoundation.org>
#
# cve_reject - Reject a reserved or published CVE entry.
#
# Usage:
#	cve_reject [CVE_ENTRY]
#

KERNEL_TREE=${CVEKERNELTREE}

if [ ! -d ${KERNEL_TREE} ]; then
       echo "CVEKERNELTREE needs setting to the stable repo directory"
       echo "Either manually export it or add it to your .bashrc/.zshrc et al."
       echo "See HOWTO in the root of this repo"
       exit 1
fi

# Colors are good!
if [[ -t 1 ]]; then
	txtred=$(tput setaf 1)		# Red
	txtgrn=$(tput setaf 2)		# Green
	txtylw=$(tput setaf 3)		# Yellow
	txtblu=$(tput setaf 4)		# Blue
	txtcyn=$(tput setaf 6)		# Cyan
	txtrst=$(tput sgr0)		# Text reset
else
	txtred=""
	txtgrn=""
	txtylw=""
	txtblu=""
	txtcyn=""
	txtrst=""
fi

# don't use unset variables
set -o nounset

# set where the tool was run from,
# the name of our script,
# and the git version of it
DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
SCRIPT=${0##*/}
SCRIPT_VERSION=$(cd "${DIR}" && git ls-tree --abbrev=12 HEAD | grep "${SCRIPT}" | awk '{print $3}')

help() {
	echo "${SCRIPT} [CVE_ENTRY]"
	exit 1
}

CVE_ENTRY="${1:-}"
if [[ "${CVE_ENTRY}" == "" ]] ; then
	help
fi


year_from_cve()
{
	local cve=$1
	local array=(${cve//-/ })
	local year=${array[1]}
	echo "${year}"
}


CVE_ROOT="${DIR}/../cve/"

# make sure that this is even a valid CVE for us to handle
f=$(find "${CVE_ROOT}/" -type f | grep "${CVE_ENTRY}")
if [[ "${f}" == "" ]]; then
	echo "${txtred}No CVE entry found for ${txtcyn}${CVE_ENTRY}${txtrst}, are you sure it is correct?"
	exit 1
fi

year=$(year_from_cve "${CVE_ENTRY}")
#echo "year=${year}"

RESERVED_DIR="${CVE_ROOT}reserved/${year}/"
PUBLISHED_DIR="${CVE_ROOT}published/${year}/"
REJECTED_DIR="${CVE_ROOT}rejected/${year}/"

EMAIL="$(git config --get user.email)"
NAME="$(git config --get user.name)"

# find the files for a published CVE
files=()
f=$(find "${CVE_ROOT}/published" -type f | grep "${CVE_ENTRY}")
if [[ "$f" != "" ]]; then
	# found something, let's figure out if we have enough
	for entry in ${f}; do
		files+=(${entry})
	done
	#echo "files found = ${#files[@]}"
	if [[ "${#files[@]}" < "4" ]]; then
		echo "${txtred}The number of files found is ${txtcyn}${#files[@]}${txtrst}, when is should be at least 4, what is going on?"
		echo "${txtred}files are:${txtrst}"
		for entry in "${files[@]}"; do
			echo "	${txtcyn}${entry}${txtrst}"
			done
		echo "${txtred}Exiting, please fix up!${txtrst}"
		exit 1
	fi

	# let's move all the files to the reserved directory for this year
	mkdir "${REJECTED_DIR}" 2> /dev/null
	for entry in "${files[@]}"; do
		mv --force "${entry}" "${REJECTED_DIR}"
	done

	# Compose an email to send out, and set the "In-Reply-To:" field properly
	rejected_mbox="${REJECTED_DIR}/${CVE_ENTRY}.mbox.rejected"
	message_id=$(cat "${REJECTED_DIR}"/"${CVE_ENTRY}".mbox | grep "^Message-Id:" | awk '{print $2}')
	subject=$(cat "${REJECTED_DIR}"/"${CVE_ENTRY}".mbox | grep "^Subject:" | sed -e 's/^Subject://')
	cat << EOF > "${rejected_mbox}"
From ${SCRIPT}-${SCRIPT_VERSION} Mon Sep 17 00:00:00 2001
From: ${NAME} <${EMAIL}>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: REJECTED:${subject}
In-Reply-To: ${message_id}


${CVE_ENTRY} has now been rejected and is no longer a valid CVE.

EOF
	echo "Rejected message is at ${txtcyn}${rejected_mbox}${txtrst}"
	echo "To send it, please run"
	echo "	${txtgrn}git send-email ${rejected_mbox}${txtrst}"
	echo ""

else
	# Let's look in the reserved section
	# FIXME: not done yet.
	echo "${txtred}FIXME!${txtrst}  ${txtcyn}${CVE_ENTRY}${txtrst} not found in the published area, is it somewhere else?"
	echo "the file ${txtcyn}${f}${txtrst} seemed to match???"
	exit 1
fi

echo "To reject the CVE with cve.org, please run:"
echo "	${txtgrn}cve -o Linux reject ${CVE_ENTRY} -j '{\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}]}'${txtrst}"

exit