import_debian does not record issues introduced via stable
import_debian.py records fixes that go into Debian stable branches
from kernel.org stable branches. It should also record issues that
are introduced into Debian branches in the same way.
For example, CVE-2020-16119 affects debian/stretch but this hasn't been noted automatically.
This could be done through something like:
- For each Debian branch:
- Look up the current released version of the linux source package. (Check both the main and security archives and use the higher version.)
- Extract the upstream part of the version number, and map that to the git tag and stable branch names.
- For each issue, and for each Debian branch:
- If the issue was introduced on the corresponding stable branch,
use
git merge-base --is-ancestorto check whether it was introduced before the current released version. - If it was introduced, record the current version in the
introduced-byfield.
- If the issue was introduced on the corresponding stable branch,
use
However, this would often result in recording issues as being introduced in a later version than they were really introduced. It would be better if the Debian tracker was changed to explicitly record when issues have been introduced.