diff --git a/scripts/check-kernel-fix b/scripts/check-kernel-fix index cf7dc40..b56c2ae 100755 --- a/scripts/check-kernel-fix +++ b/scripts/check-kernel-fix @@ -7,24 +7,32 @@ usage() { echo "Check state of a kernel fix and eventually suggest needed actions" echo - echo "Expect upstream kernel tree sha or CVE number as the parameter. The script checks" - echo "whether the commit is already in the upstream baseline or backported" - echo "in kernel-source tree. When backported, it checks whether it has CVE" - echo "reference if there is any" + echo "Expect upstream kernel tree sha or CVE number as the parameter." + echo "The script checks whether the commit is already in the upstream" + echo "baseline or backported in kernel-source tree." + echo + echo "If backported, checks for CVE/bsc references and recommends adding these" + echo "if they are missing. (Requires VULNS_GIT pointing to" + echo "https://git.kernel.org/pub/scm/linux/security/vulns.git tree." + echo "This will also allow cve number instead of sha and it resolves proer" + echo "upstream commit automatically." echo echo "Also the script looks for \"Fixes:\" tag of the given \"sha\"." - echo "When defined, the scripts informs where the fix has to be backported." + echo "When defined, the script informs where the fix has to be backported." echo echo "The script also takes into account the hierarchy of branches." echo "It checks all branches. But the action is proposed only for" echo "the top level ones. The assumption is that the other branches" echo "will get the fix via a merge." echo - echo "Usage: ${0##*/} [options] [sha] [reference]..." + echo "If the patch has CVE number with CVSS score associated then limits" + echo "actions only to CVSS affected branches." + echo + echo "Usage: ${0##*/} [options] sha|CVE" echo echo "Parameters:" echo " sha: sha of the upstream commit" - echo " reference: reference to be checked, e.g. bsc#123456 and/or CVE-XXXX-YYYY" + echo " cve: CVE-XXXX-YYYY of the upstream commit (requires VULNS_GIT_PATH)" echo echo "Options:" echo " -c: check also CVE branches" @@ -387,6 +395,7 @@ if [ -n "$cve" ] then bsc=$(cve2bugzilla $cve) cvss=$(cve2cvss $cve) + echo "Security fix for $cve with CVSS ${cvss:-unknown}" fi references="$cve $bsc"