Changes to accomodate checks if cve-bf are cves as well by roxanan1996 · Pull Request #65 · ctrliq/kernel-src-tree-tools

roxanan1996 · 2026-04-24T14:17:43Z

Description

Started from the need to detect if the cve-bf dependencies are cves and if so to adjust the commit message
accordingly. This lead to multiple changes, more or less needed to make it happen, and some that were adjacent fixes and code deduplication.

Example PR where this happened and someone has to intervene to fix it after the PR was created.

[ciqlts9_6] Multiple patches tested (5 commits) kernel-src-tree#1075 (comment)

Example PR where it was flagged that a commit was a cve, even though that was rejected
ctrliq/kernel-src-tree#1116 (comment)

Main changes and the reason behind it:

added jira helpers in kt/ktlib/jira.py, needed to find the new jira ticket for the deps that are cves as well.
Added the actual logic to detect if the cve-bf are cves as well and adjust the commit message + update the jira ticket
In case the cve-bf dependency is a cve and has a corresponding jira ticket,
it would be left unassigned. Then the pr_jira_check.py would complain.
In order to avoid this, and the "incomplete" logic of updating jira tickets
only for cve-bf commits, ciq-cherry-pick.py now updates the jira tickets
by default (for the initial CVE and for the dependencies that are CVEs),
unless --jira-dry-run is being used. This way, we don't end up with a weird
state where just one ticket is updated and the others are not.

Extra arguments were added:

jira credentials because we now do jira queries
vuln repo path to check if a CVE matches a commit
jira-dry-run as described above

ciq_helpers is moved to kt/ktlib so we can import it in other projects as well (cve_remediation)
the cve_check used did not check if the cve was rejected or published. That's now fixed.
Added kernel-info command to kt that exports the info from kt/data/kernels.yml
Kt is now installable, no need to add it to PATH anymore.

Note

ciq-cherry-pick.py is a bit convoluted, will refactor it before further improvements.
Main problem is the number of arguments that lead to multiple code paths.

1. Moved run_cve_search from check_kernel_commits.py to ciq_helpers.py 2. Created a wrapper that parses the output of run_cve_search and return the cve number. 3. Used the wrapper instead of doing the same thing twice in check_kernel_commits.py Bonus: This also reduces the level of identation in check_kernel_commits. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Useful because kt is exposed as package and these helpers can be used in multiple places, not only this repo. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Copilot

Pull request overview

This PR updates the tooling to better support CVE-related cherry-pick workflows by centralizing CVE lookup logic, adding JIRA automation support, and packaging kt as an installable CLI entrypoint.

Changes:

Switch various top-level scripts to import helpers from kt.ktlib.ciq_helpers.
Add CVE lookup + vulns repo setup helpers, and integrate them into ciq-cherry-pick.py and check_kernel_commits.py.
Add a new kt kernel_info command and introduce a kt console script entrypoint via pyproject.toml.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
update_lt_spec.py	Updates helper imports to use the packaged `kt.ktlib` path.
rolling-release-update.py	Updates helper import to use the packaged `kt.ktlib` path.
pyproject.toml	Adds a `kt` console script entrypoint.
kt/ktlib/jira.py	Introduces a JIRA wrapper used by automation flows.
kt/ktlib/ciq_helpers.py	Adds shared CVE lookup and vulns repo setup helpers.
kt/kt.py	Registers the new `kernel_info` subcommand.
kt/KT.md	Updates installation guidance to reflect installing `kt`.
kt/commands/kernel_info/impl.py	Implements kernel metadata output as JSON.
kt/commands/kernel_info/command.py	Adds Click wiring and help text for `kernel_info`.
ciq-cherry-pick.py	Adds CVE validation, JIRA ticket mapping, and JIRA updates on success/failure.
check_kernel_commits.py	Reuses shared CVE helpers and vulns repo setup logic.

Comments suppressed due to low confidence (1)

kt/ktlib/ciq_helpers.py:546

Docstring typos in the newly added CIQ_setup_vulns_repo() documentation: “Setups” → “Sets up”, and “errros” → “errors”.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

PlaidCat · 2026-04-28T17:11:02Z

+    jira_key = args.jira_key or os.environ.get("JIRA_API_TOKEN")
+
+    if not all([jira_url, jira_user, jira_key]):
+        print("WARNING: JIRA credentials not provided. Set via --jira-* args or environment variables.")


For external users using this a WARNING might be a little strong. Granted its generally a SINGLE user at the moment.

Perhaps [NOTE]?

Changed to [NOTE].

PlaidCat · 2026-04-28T17:21:48Z

+    if CIQ_check_if_published_cve(vulns_repo=vulns_repo, cve_id=cve_id):
+        return cve_id


I'm wondering if we should make note that the CVE is rejected or well dropped from the run_cve_search (i believe thats what happens when it is in the system but no longer published)

its just silent at this point and we've seen Red Hat Publish rejected CVEs due to when it was rejected. So might be a good thing to log

Yes, it could be useful.

Added a log

bmastbergen

A couple little things

bmastbergen · 2026-04-28T19:39:11Z

+
+    # Find the jira ticket corresponding to the CVE only if jira_instance
+    kernel = find_lts_kernel(jira_instance=jira_instance, jira_ticket=jira_ticket)
+    if matching_cve not in ciq_tags[0]:


I think not in here will be a substring check, yes? then we could erroneously match CVE-2026-1234 with CVE-2026-12345. Not likely, but maybe this should be != ?

Yup, wil fix it

Fixed, I extract the cve properly now

bmastbergen · 2026-04-28T19:42:17Z

 	"pathlib3x",
 	"python3-wget",
 	"oyaml",
 	"pexpect",


Should we add jira and requests here now?

Great point

Added them and removed them from kernel-tools.

shreeya-patel98 · 2026-04-28T20:45:56Z

+        update_jira_failure(jira_instance=jira_instance, ticket_key=updated_jira_ticket, jira_dry_run=jira_dry_run)
+        raise e
+
+    update_jira_success(jira_instance=jira_instance, ticket_key=updated_jira_ticket, jira_dry_run=jira_dry_run)


update_jira_success runs before cherry_pick_fixes. If cherry_pick_fixes fails, the Jira ticket has already been transitioned to In Progress and had a worklog added, but the cherry-pick is incomplete.

Good point. For manual work this is fine, because the ciq-cherry-pick is incomplete, manual stuff has to be done.
But, in the context of cve_remediation this is a problem. Will address this.

update_jira_success is now done after the cve-bf deps are cherry pickes.
I added a TODO there to add extra info in case the deps were not clean cherry picks, but won't do this now.
Thanks again for catching this.

Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

If so, use the proper tag and jira ticket (if it exists). If no jira ticket is found, the original one will be used. In case the cve-bf dependency is a cve and has a corresponding jira ticket, it would be left unassigned. Then the pr_jira_check.py would complain. In order to avoid this, and the "incomplete" logic of updating jira tickets only for cve-bf commits, ciq-cherry-pick.py now updates the jira tickets by default (for the initial CVE and for the dependencies that are CVEs), unless --jira-dry-run is being used. This way, we don't end up with a weird state where just one ticket is updated and the others are not. Extra arguments were needed: - jira credentials because we now do jira queries - vuln repo path to check if a CVE matches a commit - jira-dry-run as described above Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

CIQ_find_matching_cve returned the matching CVE even if it's rejected because the cve_search script from the vuln repo does not check if the CVE is published or rejected. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

It prints a json that matches the kernel information from kt/data/kernels.yml Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

…alled Had to move kt script to kt/kt.py Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

The project is installable. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

PlaidCat

roxanan1996 added 2 commits April 23, 2026 16:40

kt: Move ciq_helpers.py to ktlib

a12bbd3

Useful because kt is exposed as package and these helpers can be used in multiple places, not only this repo. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Copilot AI review requested due to automatic review settings April 24, 2026 14:17

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread kt/ktlib/jira.py

Comment thread kt/ktlib/jira.py

Comment thread kt/ktlib/jira.py

Comment thread ciq-cherry-pick.py

Comment thread ciq-cherry-pick.py

Comment thread pyproject.toml

Comment thread kt/commands/kernel_info/command.py Outdated

Comment thread pyproject.toml

roxanan1996 force-pushed the {rnicolescu}_cve-bf-modify-during-cherry-pick branch from 4701f2d to cae02b9 Compare April 24, 2026 14:51

roxanan1996 self-assigned this Apr 24, 2026

PlaidCat reviewed Apr 28, 2026

View reviewed changes

bmastbergen reviewed Apr 28, 2026

View reviewed changes

shreeya-patel98 reviewed Apr 29, 2026

View reviewed changes

roxanan1996 added 8 commits April 29, 2026 14:01

kt/ktlib: Introduce jira helpers

656037c

Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

kt/ktlib/ciq_helpers.py: Add helper that sets up the vuln repo

65ca079

Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

kt: Add kernel-info command

cdb0f4f

It prints a json that matches the kernel information from kt/data/kernels.yml Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

kt/ktlib/jira.py: Add helper to unassign tickets

362a68e

Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

pyproject.toml: Automatically kt as CLI tool when the project is inst…

ff9921e

…alled Had to move kt script to kt/kt.py Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

pyproject.toml: Remove obsolete comment

079de11

The project is installable. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Copilot AI review requested due to automatic review settings April 29, 2026 12:35

roxanan1996 force-pushed the {rnicolescu}_cve-bf-modify-during-cherry-pick branch from cae02b9 to 079de11 Compare April 29, 2026 12:35

Copilot started reviewing on behalf of roxanan1996 April 29, 2026 12:35 View session

roxanan1996 changed the title ~~{rnicolescu} CVE bf modify during cherry pick~~ Changes to accomodate checks if cve-bf are cves as well Apr 29, 2026

This comment was marked as spam.

Sign in to view

PlaidCat approved these changes Apr 29, 2026

View reviewed changes

		if CIQ_check_if_published_cve(vulns_repo=vulns_repo, cve_id=cve_id):
		return cve_id

Conversation

roxanan1996 commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Note

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PlaidCat Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PlaidCat Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as spam.

Uh oh!

PlaidCat left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

roxanan1996 commented Apr 24, 2026 •

edited

Loading

PlaidCat Apr 28, 2026 •

edited

Loading

PlaidCat Apr 28, 2026 •

edited

Loading